xref: /openbsd-src/sys/dev/ic/atw.c (revision a28daedfc357b214be5c701aa8ba8adb29a7f1c2)
1 /*	$OpenBSD: atw.c,v 1.65 2009/01/21 21:53:59 grange Exp $	*/
2 /*	$NetBSD: atw.c,v 1.69 2004/07/23 07:07:55 dyoung Exp $	*/
3 
4 /*-
5  * Copyright (c) 1998, 1999, 2000, 2002, 2003, 2004 The NetBSD Foundation, Inc.
6  * All rights reserved.
7  *
8  * This code is derived from software contributed to The NetBSD Foundation
9  * by David Young, by Jason R. Thorpe, and by Charles M. Hannum.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Device driver for the ADMtek ADM8211 802.11 MAC/BBP.
35  */
36 
37 #include "bpfilter.h"
38 
39 #include <sys/param.h>
40 #include <sys/systm.h>
41 #include <sys/mbuf.h>
42 #include <sys/malloc.h>
43 #include <sys/kernel.h>
44 #include <sys/socket.h>
45 #include <sys/ioctl.h>
46 #include <sys/errno.h>
47 #include <sys/device.h>
48 #include <sys/time.h>
49 
50 #include <machine/endian.h>
51 
52 #include <uvm/uvm_extern.h>
53 
54 #include <net/if.h>
55 #include <net/if_dl.h>
56 #include <net/if_media.h>
57 
58 #if NBPFILTER > 0
59 #include <net/bpf.h>
60 #endif
61 
62 #ifdef INET
63 #include <netinet/in.h>
64 #include <netinet/if_ether.h>
65 #endif
66 
67 #include <net80211/ieee80211_var.h>
68 #include <net80211/ieee80211_radiotap.h>
69 
70 #include <machine/bus.h>
71 #include <machine/intr.h>
72 
73 #include <dev/ic/atwreg.h>
74 #include <dev/ic/rf3000reg.h>
75 #include <dev/ic/si4136reg.h>
76 #include <dev/ic/atwvar.h>
77 #include <dev/ic/smc93cx6var.h>
78 
79 /* XXX TBD open questions
80  *
81  *
82  * When should I set DSSS PAD in reg 0x15 of RF3000? In 1-2Mbps
83  * modes only, or all modes (5.5-11 Mbps CCK modes, too?) Does the MAC
84  * handle this for me?
85  *
86  */
87 /* device attachment
88  *
89  *    print TOFS[012]
90  *
91  * device initialization
92  *
93  *    clear ATW_FRCTL_MAXPSP to disable max power saving
94  *    set ATW_TXBR_ALCUPDATE to enable ALC
95  *    set TOFS[012]? (hope not)
96  *    disable rx/tx
97  *    set ATW_PAR_SWR (software reset)
98  *    wait for ATW_PAR_SWR clear
99  *    disable interrupts
100  *    ack status register
101  *    enable interrupts
102  *
103  * rx/tx initialization
104  *
105  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
106  *    allocate and init descriptor rings
107  *    write ATW_PAR_DSL (descriptor skip length)
108  *    write descriptor base addrs: ATW_TDBD, ATW_TDBP, write ATW_RDB
109  *    write ATW_NAR_SQ for one/both transmit descriptor rings
110  *    write ATW_NAR_SQ for one/both transmit descriptor rings
111  *    enable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
112  *
113  * rx/tx end
114  *
115  *    stop DMA
116  *    disable rx/tx w/ ATW_NAR_SR, ATW_NAR_ST
117  *    flush tx w/ ATW_NAR_HF
118  *
119  * scan
120  *
121  *    initialize rx/tx
122  *
123  * BSS join: (re)association response
124  *
125  *    set ATW_FRCTL_AID
126  *
127  * optimizations ???
128  *
129  */
130 
131 #define ATW_REFSLAVE	/* slavishly do what the reference driver does */
132 
133 int atw_bbp_io_enable_delay = 20 * 1000;
134 int atw_bbp_io_disable_delay = 2 * 1000;
135 int atw_writewep_delay = 1000;
136 int atw_beacon_len_adjust = 4;
137 int atw_dwelltime = 200;
138 int atw_xindiv2 = 0;
139 
140 #ifdef ATW_DEBUG
141 int atw_debug = 0;
142 
143 #define ATW_DPRINTF(x)	if (atw_debug > 0) printf x
144 #define ATW_DPRINTF2(x)	if (atw_debug > 1) printf x
145 #define ATW_DPRINTF3(x)	if (atw_debug > 2) printf x
146 #define	DPRINTF(sc, x)	if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) printf x
147 #define	DPRINTF2(sc, x)	if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) ATW_DPRINTF2(x)
148 #define	DPRINTF3(sc, x)	if ((sc)->sc_ic.ic_if.if_flags & IFF_DEBUG) ATW_DPRINTF3(x)
149 void atw_print_regs(struct atw_softc *, const char *);
150 void atw_dump_pkt(struct ifnet *, struct mbuf *);
151 
152 /* Note well: I never got atw_rf3000_read or atw_si4126_read to work. */
153 #	ifdef ATW_BBPDEBUG
154 int atw_rf3000_read(struct atw_softc *sc, u_int, u_int *);
155 void atw_rf3000_print(struct atw_softc *);
156 #	endif /* ATW_BBPDEBUG */
157 
158 #	ifdef ATW_SYNDEBUG
159 int atw_si4126_read(struct atw_softc *, u_int, u_int *);
160 void atw_si4126_print(struct atw_softc *);
161 #	endif /* ATW_SYNDEBUG */
162 
163 #else
164 #define ATW_DPRINTF(x)
165 #define ATW_DPRINTF2(x)
166 #define ATW_DPRINTF3(x)
167 #define	DPRINTF(sc, x)	/* nothing */
168 #define	DPRINTF2(sc, x)	/* nothing */
169 #define	DPRINTF3(sc, x)	/* nothing */
170 #endif
171 
172 #ifdef ATW_STATS
173 void	atw_print_stats(struct atw_softc *);
174 #endif
175 
176 const char *atw_printmac(u_int8_t);
177 
178 /* ifnet methods */
179 void	atw_start(struct ifnet *);
180 void	atw_watchdog(struct ifnet *);
181 int	atw_ioctl(struct ifnet *, u_long, caddr_t);
182 int	atw_init(struct ifnet *);
183 void	atw_stop(struct ifnet *, int);
184 
185 /* Rx/Tx process */
186 void	atw_rxdrain(struct atw_softc *);
187 void	atw_txdrain(struct atw_softc *);
188 int	atw_add_rxbuf(struct atw_softc *, int);
189 void	atw_idle(struct atw_softc *, u_int32_t);
190 
191 /* Device (de)activation and power state */
192 void	atw_disable(struct atw_softc *);
193 void	atw_reset(struct atw_softc *);
194 
195 /* Interrupt handlers */
196 void	atw_rxintr(struct atw_softc *);
197 void	atw_txintr(struct atw_softc *);
198 void	atw_linkintr(struct atw_softc *, u_int32_t);
199 
200 /* 802.11 state machine */
201 int	atw_newstate(struct ieee80211com *, enum ieee80211_state, int);
202 int	atw_tune(struct atw_softc *);
203 #ifndef IEEE80211_STA_ONLY
204 void	atw_recv_mgmt(struct ieee80211com *, struct mbuf *,
205 	    struct ieee80211_node *, struct ieee80211_rxinfo *, int);
206 #endif
207 void	atw_next_scan(void *);
208 
209 /* Device initialization */
210 void	atw_wcsr_init(struct atw_softc *);
211 void	atw_cmdr_init(struct atw_softc *);
212 void	atw_tofs2_init(struct atw_softc *);
213 void	atw_txlmt_init(struct atw_softc *);
214 void	atw_test1_init(struct atw_softc *);
215 void	atw_rf_reset(struct atw_softc *);
216 void	atw_cfp_init(struct atw_softc *);
217 void	atw_tofs0_init(struct atw_softc *);
218 void	atw_ifs_init(struct atw_softc *);
219 void	atw_response_times_init(struct atw_softc *);
220 void	atw_bbp_io_init(struct atw_softc *);
221 void	atw_nar_init(struct atw_softc *);
222 
223 /* RAM/ROM utilities */
224 void	atw_clear_sram(struct atw_softc *);
225 void	atw_write_sram(struct atw_softc *, u_int, u_int8_t *, u_int);
226 int	atw_read_srom(struct atw_softc *);
227 
228 /* BSS setup */
229 void	atw_predict_beacon(struct atw_softc *sc);
230 void	atw_start_beacon(struct atw_softc *, int);
231 void	atw_write_bssid(struct atw_softc *);
232 void	atw_write_ssid(struct atw_softc *);
233 void	atw_write_sup_rates(struct atw_softc *);
234 void	atw_write_wep(struct atw_softc *);
235 
236 /* Media */
237 int	atw_media_change(struct ifnet *);
238 void	atw_media_status(struct ifnet *, struct ifmediareq *);
239 
240 void	atw_filter_setup(struct atw_softc *);
241 
242 /* 802.11 utilities */
243 struct	ieee80211_node *atw_node_alloc(struct ieee80211com *);
244 void	atw_node_free(struct ieee80211com *, struct ieee80211_node *);
245 static	__inline uint32_t atw_last_even_tsft(uint32_t, uint32_t, uint32_t);
246 uint64_t atw_get_tsft(struct atw_softc *sc);
247 void	atw_change_ibss(struct atw_softc *);
248 int	atw_compute_duration1(int, int, uint32_t, int, struct atw_duration *);
249 int	atw_compute_duration(struct ieee80211_frame *, int, uint32_t, int,
250 	    int, struct atw_duration *, struct atw_duration *, int *, int);
251 
252 /*
253  * Tuner/transceiver/modem
254  */
255 void	atw_bbp_io_enable(struct atw_softc *, int);
256 
257 /* RFMD RF3000 Baseband Processor */
258 int	atw_rf3000_init(struct atw_softc *);
259 int	atw_rf3000_tune(struct atw_softc *, u_int);
260 int	atw_rf3000_write(struct atw_softc *, u_int, u_int);
261 
262 /* Silicon Laboratories Si4126 RF/IF Synthesizer */
263 void	atw_si4126_tune(struct atw_softc *, u_int);
264 void	atw_si4126_write(struct atw_softc *, u_int, u_int);
265 void	atw_si4126_init(struct atw_softc *);
266 
267 const struct atw_txthresh_tab atw_txthresh_tab_lo[] = ATW_TXTHRESH_TAB_LO_RATE;
268 const struct atw_txthresh_tab atw_txthresh_tab_hi[] = ATW_TXTHRESH_TAB_HI_RATE;
269 
270 struct cfdriver atw_cd = {
271     NULL, "atw", DV_IFNET
272 };
273 
274 static const u_int atw_rfmd2958_ifn[] = {
275 	0x22bd, 0x22d2, 0x22e8, 0x22fe, 0x2314, 0x232a, 0x2340,
276 	0x2355, 0x236b, 0x2381, 0x2397, 0x23ad, 0x23c2, 0x23f7
277 };
278 
279 static const u_int atw_rfmd2958_rf1r[] = {
280 	0x05d17, 0x3a2e8, 0x2e8ba, 0x22e8b, 0x1745d, 0x0ba2e, 0x00000,
281 	0x345d1, 0x28ba2, 0x1d174, 0x11745, 0x05d17, 0x3a2e8, 0x11745
282 };
283 
284 
285 #ifdef ATW_DEBUG
286 
287 const char *atw_tx_state[] = {
288 	"STOPPED",
289 	"RUNNING - read descriptor",
290 	"RUNNING - transmitting",
291 	"RUNNING - filling fifo",	/* XXX */
292 	"SUSPENDED",
293 	"RUNNING -- write descriptor",
294 	"RUNNING -- write last descriptor",
295 	"RUNNING - fifo full"
296 };
297 
298 const char *atw_rx_state[] = {
299 	"STOPPED",
300 	"RUNNING - read descriptor",
301 	"RUNNING - check this packet, pre-fetch next",
302 	"RUNNING - wait for reception",
303 	"SUSPENDED",
304 	"RUNNING - write descriptor",
305 	"RUNNING - flush fifo",
306 	"RUNNING - fifo drain"
307 };
308 
309 #endif
310 
311 /*
312  * atw_enable:
313  *
314  *	Enable the ADM8211 chip.
315  */
316 int
317 atw_enable(struct atw_softc *sc)
318 {
319 
320 	if (ATW_IS_ENABLED(sc) == 0) {
321 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
322 			printf("%s: device enable failed\n",
323 			    sc->sc_dev.dv_xname);
324 			return (EIO);
325 		}
326 		sc->sc_flags |= ATWF_ENABLED;
327 	}
328 	return (0);
329 }
330 
331 /*
332  * atw_disable:
333  *
334  *	Disable the ADM8211 chip.
335  */
336 void
337 atw_disable(struct atw_softc *sc)
338 {
339 	if (!ATW_IS_ENABLED(sc))
340 		return;
341 	if (sc->sc_disable != NULL)
342 		(*sc->sc_disable)(sc);
343 	sc->sc_flags &= ~ATWF_ENABLED;
344 }
345 
346 /* Returns -1 on failure. */
347 int
348 atw_read_srom(struct atw_softc *sc)
349 {
350 	struct seeprom_descriptor sd;
351 	u_int32_t test0, fail_bits;
352 
353 	(void)memset(&sd, 0, sizeof(sd));
354 
355 	test0 = ATW_READ(sc, ATW_TEST0);
356 
357 	switch (sc->sc_rev) {
358 	case ATW_REVISION_BA:
359 	case ATW_REVISION_CA:
360 		fail_bits = ATW_TEST0_EPNE;
361 		break;
362 	default:
363 		fail_bits = ATW_TEST0_EPNE|ATW_TEST0_EPSNM;
364 		break;
365 	}
366 	if ((test0 & fail_bits) != 0) {
367 		printf("%s: bad or missing/bad SROM\n", sc->sc_dev.dv_xname);
368 		return -1;
369 	}
370 
371 	switch (test0 & ATW_TEST0_EPTYP_MASK) {
372 	case ATW_TEST0_EPTYP_93c66:
373 		ATW_DPRINTF(("%s: 93c66 SROM\n", sc->sc_dev.dv_xname));
374 		sc->sc_sromsz = 512;
375 		sd.sd_chip = C56_66;
376 		break;
377 	case ATW_TEST0_EPTYP_93c46:
378 		ATW_DPRINTF(("%s: 93c46 SROM\n", sc->sc_dev.dv_xname));
379 		sc->sc_sromsz = 128;
380 		sd.sd_chip = C46;
381 		break;
382 	default:
383 		printf("%s: unknown SROM type %d\n", sc->sc_dev.dv_xname,
384 		    MASK_AND_RSHIFT(test0, ATW_TEST0_EPTYP_MASK));
385 		return -1;
386 	}
387 
388 	sc->sc_srom = malloc(sc->sc_sromsz, M_DEVBUF, M_NOWAIT);
389 	if (sc->sc_srom == NULL) {
390 		printf("%s: unable to allocate SROM buffer\n",
391 		    sc->sc_dev.dv_xname);
392 		return -1;
393 	}
394 
395 	(void)memset(sc->sc_srom, 0, sc->sc_sromsz);
396 	/* ADM8211 has a single 32-bit register for controlling the
397 	 * 93cx6 SROM.  Bit SRS enables the serial port. There is no
398 	 * "ready" bit. The ADM8211 input/output sense is the reverse
399 	 * of read_seeprom's.
400 	 */
401 	sd.sd_tag = sc->sc_st;
402 	sd.sd_bsh = sc->sc_sh;
403 	sd.sd_regsize = 4;
404 	sd.sd_control_offset = ATW_SPR;
405 	sd.sd_status_offset = ATW_SPR;
406 	sd.sd_dataout_offset = ATW_SPR;
407 	sd.sd_CK = ATW_SPR_SCLK;
408 	sd.sd_CS = ATW_SPR_SCS;
409 	sd.sd_DI = ATW_SPR_SDO;
410 	sd.sd_DO = ATW_SPR_SDI;
411 	sd.sd_MS = ATW_SPR_SRS;
412 	sd.sd_RDY = 0;
413 
414 	if (!read_seeprom(&sd, sc->sc_srom, 0, sc->sc_sromsz/2)) {
415 		printf("%s: could not read SROM\n", sc->sc_dev.dv_xname);
416 		free(sc->sc_srom, M_DEVBUF);
417 		return -1;
418 	}
419 #ifdef ATW_DEBUG
420 	{
421 		int i;
422 		ATW_DPRINTF(("\nSerial EEPROM:\n\t"));
423 		for (i = 0; i < sc->sc_sromsz/2; i = i + 1) {
424 			if (((i % 8) == 0) && (i != 0)) {
425 				ATW_DPRINTF(("\n\t"));
426 			}
427 			ATW_DPRINTF((" 0x%x", sc->sc_srom[i]));
428 		}
429 		ATW_DPRINTF(("\n"));
430 	}
431 #endif /* ATW_DEBUG */
432 	return 0;
433 }
434 
435 #ifdef ATW_DEBUG
436 void
437 atw_print_regs(struct atw_softc *sc, const char *where)
438 {
439 #define PRINTREG(sc, reg) \
440 	ATW_DPRINTF2(("%s: reg[ " #reg " / %03x ] = %08x\n", \
441 	    sc->sc_dev.dv_xname, reg, ATW_READ(sc, reg)))
442 
443 	ATW_DPRINTF2(("%s: %s\n", sc->sc_dev.dv_xname, where));
444 
445 	PRINTREG(sc, ATW_PAR);
446 	PRINTREG(sc, ATW_FRCTL);
447 	PRINTREG(sc, ATW_TDR);
448 	PRINTREG(sc, ATW_WTDP);
449 	PRINTREG(sc, ATW_RDR);
450 	PRINTREG(sc, ATW_WRDP);
451 	PRINTREG(sc, ATW_RDB);
452 	PRINTREG(sc, ATW_CSR3A);
453 	PRINTREG(sc, ATW_TDBD);
454 	PRINTREG(sc, ATW_TDBP);
455 	PRINTREG(sc, ATW_STSR);
456 	PRINTREG(sc, ATW_CSR5A);
457 	PRINTREG(sc, ATW_NAR);
458 	PRINTREG(sc, ATW_CSR6A);
459 	PRINTREG(sc, ATW_IER);
460 	PRINTREG(sc, ATW_CSR7A);
461 	PRINTREG(sc, ATW_LPC);
462 	PRINTREG(sc, ATW_TEST1);
463 	PRINTREG(sc, ATW_SPR);
464 	PRINTREG(sc, ATW_TEST0);
465 	PRINTREG(sc, ATW_WCSR);
466 	PRINTREG(sc, ATW_WPDR);
467 	PRINTREG(sc, ATW_GPTMR);
468 	PRINTREG(sc, ATW_GPIO);
469 	PRINTREG(sc, ATW_BBPCTL);
470 	PRINTREG(sc, ATW_SYNCTL);
471 	PRINTREG(sc, ATW_PLCPHD);
472 	PRINTREG(sc, ATW_MMIWADDR);
473 	PRINTREG(sc, ATW_MMIRADDR1);
474 	PRINTREG(sc, ATW_MMIRADDR2);
475 	PRINTREG(sc, ATW_TXBR);
476 	PRINTREG(sc, ATW_CSR15A);
477 	PRINTREG(sc, ATW_ALCSTAT);
478 	PRINTREG(sc, ATW_TOFS2);
479 	PRINTREG(sc, ATW_CMDR);
480 	PRINTREG(sc, ATW_PCIC);
481 	PRINTREG(sc, ATW_PMCSR);
482 	PRINTREG(sc, ATW_PAR0);
483 	PRINTREG(sc, ATW_PAR1);
484 	PRINTREG(sc, ATW_MAR0);
485 	PRINTREG(sc, ATW_MAR1);
486 	PRINTREG(sc, ATW_ATIMDA0);
487 	PRINTREG(sc, ATW_ABDA1);
488 	PRINTREG(sc, ATW_BSSID0);
489 	PRINTREG(sc, ATW_TXLMT);
490 	PRINTREG(sc, ATW_MIBCNT);
491 	PRINTREG(sc, ATW_BCNT);
492 	PRINTREG(sc, ATW_TSFTH);
493 	PRINTREG(sc, ATW_TSC);
494 	PRINTREG(sc, ATW_SYNRF);
495 	PRINTREG(sc, ATW_BPLI);
496 	PRINTREG(sc, ATW_CAP0);
497 	PRINTREG(sc, ATW_CAP1);
498 	PRINTREG(sc, ATW_RMD);
499 	PRINTREG(sc, ATW_CFPP);
500 	PRINTREG(sc, ATW_TOFS0);
501 	PRINTREG(sc, ATW_TOFS1);
502 	PRINTREG(sc, ATW_IFST);
503 	PRINTREG(sc, ATW_RSPT);
504 	PRINTREG(sc, ATW_TSFTL);
505 	PRINTREG(sc, ATW_WEPCTL);
506 	PRINTREG(sc, ATW_WESK);
507 	PRINTREG(sc, ATW_WEPCNT);
508 	PRINTREG(sc, ATW_MACTEST);
509 	PRINTREG(sc, ATW_FER);
510 	PRINTREG(sc, ATW_FEMR);
511 	PRINTREG(sc, ATW_FPSR);
512 	PRINTREG(sc, ATW_FFER);
513 #undef PRINTREG
514 }
515 #endif /* ATW_DEBUG */
516 
517 const char*
518 atw_printmac(u_int8_t rev) {
519 	switch (rev) {
520 	case ATW_REVISION_AB:
521 		return "ADM8211AB";
522 	case ATW_REVISION_AF:
523 		return "ADM8211AF";
524 	case ATW_REVISION_BA:
525 		return "ADM8211BA";
526 	case ATW_REVISION_CA:
527 		return "ADM8211CA";
528 	default:
529 		return "unknown";
530 	}
531 }
532 
533 /*
534  * Finish attaching an ADMtek ADM8211 MAC.  Called by bus-specific front-end.
535  */
536 void
537 atw_attach(struct atw_softc *sc)
538 {
539 	static const u_int8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
540 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
541 	};
542 	struct ieee80211com *ic = &sc->sc_ic;
543 	struct ifnet *ifp = &ic->ic_if;
544 	int country_code, error, i, srom_major;
545 	u_int32_t reg;
546 	static const char *type_strings[] = {"Intersil (not supported)",
547 	    "RFMD", "Marvel (not supported)"};
548 
549 	sc->sc_txth = atw_txthresh_tab_lo;
550 
551 	SIMPLEQ_INIT(&sc->sc_txfreeq);
552 	SIMPLEQ_INIT(&sc->sc_txdirtyq);
553 
554 #ifdef ATW_DEBUG
555 	atw_print_regs(sc, "atw_attach");
556 #endif /* ATW_DEBUG */
557 
558 	/*
559 	 * Allocate the control data structures, and create and load the
560 	 * DMA map for it.
561 	 */
562 	if ((error = bus_dmamem_alloc(sc->sc_dmat,
563 	    sizeof(struct atw_control_data), PAGE_SIZE, 0, &sc->sc_cdseg,
564 	    1, &sc->sc_cdnseg, 0)) != 0) {
565 		printf("%s: unable to allocate control data, error = %d\n",
566 		    sc->sc_dev.dv_xname, error);
567 		goto fail_0;
568 	}
569 
570 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg,
571 	    sizeof(struct atw_control_data), (caddr_t *)&sc->sc_control_data,
572 	    BUS_DMA_COHERENT)) != 0) {
573 		printf("%s: unable to map control data, error = %d\n",
574 		    sc->sc_dev.dv_xname, error);
575 		goto fail_1;
576 	}
577 
578 	if ((error = bus_dmamap_create(sc->sc_dmat,
579 	    sizeof(struct atw_control_data), 1,
580 	    sizeof(struct atw_control_data), 0, 0, &sc->sc_cddmamap)) != 0) {
581 		printf("%s: unable to create control data DMA map, "
582 		    "error = %d\n", sc->sc_dev.dv_xname, error);
583 		goto fail_2;
584 	}
585 
586 	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_cddmamap,
587 	    sc->sc_control_data, sizeof(struct atw_control_data), NULL,
588 	    0)) != 0) {
589 		printf("%s: unable to load control data DMA map, error = %d\n",
590 		    sc->sc_dev.dv_xname, error);
591 		goto fail_3;
592 	}
593 
594 	/*
595 	 * Create the transmit buffer DMA maps.
596 	 */
597 	sc->sc_ntxsegs = ATW_NTXSEGS;
598 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
599 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
600 		    sc->sc_ntxsegs, MCLBYTES, 0, 0,
601 		    &sc->sc_txsoft[i].txs_dmamap)) != 0) {
602 			printf("%s: unable to create tx DMA map %d, "
603 			    "error = %d\n", sc->sc_dev.dv_xname, i, error);
604 			goto fail_4;
605 		}
606 	}
607 
608 	/*
609 	 * Create the receive buffer DMA maps.
610 	 */
611 	for (i = 0; i < ATW_NRXDESC; i++) {
612 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
613 		    MCLBYTES, 0, 0, &sc->sc_rxsoft[i].rxs_dmamap)) != 0) {
614 			printf("%s: unable to create rx DMA map %d, "
615 			    "error = %d\n", sc->sc_dev.dv_xname, i, error);
616 			goto fail_5;
617 		}
618 	}
619 	for (i = 0; i < ATW_NRXDESC; i++) {
620 		sc->sc_rxsoft[i].rxs_mbuf = NULL;
621 	}
622 
623 	switch (sc->sc_rev) {
624 	case ATW_REVISION_AB:
625 	case ATW_REVISION_AF:
626 		sc->sc_sramlen = ATW_SRAM_A_SIZE;
627 		break;
628 	case ATW_REVISION_BA:
629 	case ATW_REVISION_CA:
630 		sc->sc_sramlen = ATW_SRAM_B_SIZE;
631 		break;
632 	}
633 
634 	/* Reset the chip to a known state. */
635 	atw_reset(sc);
636 
637 	if (atw_read_srom(sc) == -1)
638 		return;
639 
640 	sc->sc_rftype = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CSR20],
641 	    ATW_SR_RFTYPE_MASK);
642 
643 	sc->sc_bbptype = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CSR20],
644 	    ATW_SR_BBPTYPE_MASK);
645 
646 	if (sc->sc_rftype >= sizeof(type_strings)/sizeof(type_strings[0])) {
647 		printf("%s: unknown RF\n", sc->sc_dev.dv_xname);
648 		return;
649 	}
650 	if (sc->sc_bbptype >= sizeof(type_strings)/sizeof(type_strings[0])) {
651 		printf("%s: unknown BBP\n", sc->sc_dev.dv_xname);
652 		return;
653 	}
654 
655 	printf("%s: MAC %s, BBP %s, RF %s", sc->sc_dev.dv_xname,
656 	    atw_printmac(sc->sc_rev), type_strings[sc->sc_bbptype],
657 	    type_strings[sc->sc_rftype]);
658 
659 	/* XXX There exists a Linux driver which seems to use RFType = 0 for
660 	 * MARVEL. My bug, or theirs?
661 	 */
662 
663 	reg = LSHIFT(sc->sc_rftype, ATW_SYNCTL_RFTYPE_MASK);
664 
665 	switch (sc->sc_rftype) {
666 	case ATW_RFTYPE_INTERSIL:
667 		reg |= ATW_SYNCTL_CS1;
668 		break;
669 	case ATW_RFTYPE_RFMD:
670 		reg |= ATW_SYNCTL_CS0;
671 		break;
672 	case ATW_RFTYPE_MARVEL:
673 		break;
674 	}
675 
676 	sc->sc_synctl_rd = reg | ATW_SYNCTL_RD;
677 	sc->sc_synctl_wr = reg | ATW_SYNCTL_WR;
678 
679 	reg = LSHIFT(sc->sc_bbptype, ATW_BBPCTL_TYPE_MASK);
680 
681 	switch (sc->sc_bbptype) {
682 	case ATW_BBPTYPE_INTERSIL:
683 		reg |= ATW_BBPCTL_TWI;
684 		break;
685 	case ATW_BBPTYPE_RFMD:
686 		reg |= ATW_BBPCTL_RF3KADDR_ADDR | ATW_BBPCTL_NEGEDGE_DO |
687 		    ATW_BBPCTL_CCA_ACTLO;
688 		break;
689 	case ATW_BBPTYPE_MARVEL:
690 		break;
691 	case ATW_C_BBPTYPE_RFMD:
692 		printf("%s: ADM8211C MAC/RFMD BBP not supported yet.\n",
693 		    sc->sc_dev.dv_xname);
694 		break;
695 	}
696 
697 	sc->sc_bbpctl_wr = reg | ATW_BBPCTL_WR;
698 	sc->sc_bbpctl_rd = reg | ATW_BBPCTL_RD;
699 
700 	/*
701 	 * From this point forward, the attachment cannot fail.  A failure
702 	 * before this point releases all resources that may have been
703 	 * allocated.
704 	 */
705 	sc->sc_flags |= ATWF_ATTACHED /* | ATWF_RTSCTS */;
706 
707 	ATW_DPRINTF((" SROM MAC %04x%04x%04x",
708 	    htole16(sc->sc_srom[ATW_SR_MAC00]),
709 	    htole16(sc->sc_srom[ATW_SR_MAC01]),
710 	    htole16(sc->sc_srom[ATW_SR_MAC10])));
711 
712 	srom_major = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_FORMAT_VERSION],
713 	    ATW_SR_MAJOR_MASK);
714 
715 	if (srom_major < 2)
716 		sc->sc_rf3000_options1 = 0;
717 	else if (sc->sc_rev == ATW_REVISION_BA) {
718 		sc->sc_rf3000_options1 =
719 		    MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CR28_CR03],
720 		    ATW_SR_CR28_MASK);
721 	} else
722 		sc->sc_rf3000_options1 = 0;
723 
724 	sc->sc_rf3000_options2 = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CTRY_CR29],
725 	    ATW_SR_CR29_MASK);
726 
727 	country_code = MASK_AND_RSHIFT(sc->sc_srom[ATW_SR_CTRY_CR29],
728 	    ATW_SR_CTRY_MASK);
729 
730 #define ADD_CHANNEL(_ic, _chan) do {					\
731 	_ic->ic_channels[_chan].ic_flags = IEEE80211_CHAN_B;		\
732 	_ic->ic_channels[_chan].ic_freq =				\
733 	    ieee80211_ieee2mhz(_chan, _ic->ic_channels[_chan].ic_flags);\
734 } while (0)
735 
736 	/* Find available channels */
737 	switch (country_code) {
738 	case COUNTRY_MMK2:	/* 1-14 */
739 		ADD_CHANNEL(ic, 14);
740 		/*FALLTHROUGH*/
741 	case COUNTRY_ETSI:	/* 1-13 */
742 		for (i = 1; i <= 13; i++)
743 			ADD_CHANNEL(ic, i);
744 		break;
745 	case COUNTRY_FCC:	/* 1-11 */
746 	case COUNTRY_IC:	/* 1-11 */
747 		for (i = 1; i <= 11; i++)
748 			ADD_CHANNEL(ic, i);
749 		break;
750 	case COUNTRY_MMK:	/* 14 */
751 		ADD_CHANNEL(ic, 14);
752 		break;
753 	case COUNTRY_FRANCE:	/* 10-13 */
754 		for (i = 10; i <= 13; i++)
755 			ADD_CHANNEL(ic, i);
756 		break;
757 	default:	/* assume channels 10-11 */
758 	case COUNTRY_SPAIN:	/* 10-11 */
759 		for (i = 10; i <= 11; i++)
760 			ADD_CHANNEL(ic, i);
761 		break;
762 	}
763 
764 	/* Read the MAC address. */
765 	reg = ATW_READ(sc, ATW_PAR0);
766 	ic->ic_myaddr[0] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB0_MASK);
767 	ic->ic_myaddr[1] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB1_MASK);
768 	ic->ic_myaddr[2] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB2_MASK);
769 	ic->ic_myaddr[3] = MASK_AND_RSHIFT(reg, ATW_PAR0_PAB3_MASK);
770 	reg = ATW_READ(sc, ATW_PAR1);
771 	ic->ic_myaddr[4] = MASK_AND_RSHIFT(reg, ATW_PAR1_PAB4_MASK);
772 	ic->ic_myaddr[5] = MASK_AND_RSHIFT(reg, ATW_PAR1_PAB5_MASK);
773 
774 	if (IEEE80211_ADDR_EQ(ic->ic_myaddr, empty_macaddr)) {
775 		printf(" could not get mac address, attach failed\n");
776 		return;
777 	}
778 
779 	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
780 
781 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
782 	ifp->if_softc = sc;
783 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST |
784 	    IFF_NOTRAILERS;
785 	ifp->if_ioctl = atw_ioctl;
786 	ifp->if_start = atw_start;
787 	ifp->if_watchdog = atw_watchdog;
788 	IFQ_SET_READY(&ifp->if_snd);
789 
790 	ic->ic_phytype = IEEE80211_T_DS;
791 	ic->ic_opmode = IEEE80211_M_STA;
792 	ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_MONITOR | IEEE80211_C_WEP;
793 #ifndef IEEE80211_STA_ONLY
794 	ic->ic_caps |= IEEE80211_C_IBSS;
795 #endif
796 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
797 
798 	/*
799 	 * Call MI attach routines.
800 	 */
801 
802 	if_attach(ifp);
803 	ieee80211_ifattach(ifp);
804 
805 	sc->sc_newstate = ic->ic_newstate;
806 	ic->ic_newstate = atw_newstate;
807 
808 #ifndef IEEE80211_STA_ONLY
809 	sc->sc_recv_mgmt = ic->ic_recv_mgmt;
810 	ic->ic_recv_mgmt = atw_recv_mgmt;
811 #endif
812 
813 	sc->sc_node_free = ic->ic_node_free;
814 	ic->ic_node_free = atw_node_free;
815 
816 	sc->sc_node_alloc = ic->ic_node_alloc;
817 	ic->ic_node_alloc = atw_node_alloc;
818 
819 	/* possibly we should fill in our own sc_send_prresp, since
820 	 * the ADM8211 is probably sending probe responses in ad hoc
821 	 * mode.
822 	 */
823 
824 	/* complete initialization */
825 	ieee80211_media_init(ifp, atw_media_change, atw_media_status);
826 	timeout_set(&sc->sc_scan_to, atw_next_scan, sc);
827 
828 #if NBPFILTER > 0
829 	bpfattach(&sc->sc_radiobpf, ifp, DLT_IEEE802_11_RADIO,
830 	    sizeof(struct ieee80211_frame) + 64);
831 #endif
832 
833 	/*
834 	 * Make sure the interface is shutdown during reboot.
835 	 */
836 	sc->sc_sdhook = shutdownhook_establish(atw_shutdown, sc);
837 	if (sc->sc_sdhook == NULL)
838 		printf("%s: WARNING: unable to establish shutdown hook\n",
839 		    sc->sc_dev.dv_xname);
840 
841 	/*
842 	 * Add a suspend hook to make sure we come back up after a
843 	 * resume.
844 	 */
845 	sc->sc_powerhook = powerhook_establish(atw_power, sc);
846 	if (sc->sc_powerhook == NULL)
847 		printf("%s: WARNING: unable to establish power hook\n",
848 		    sc->sc_dev.dv_xname);
849 
850 	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
851 	sc->sc_rxtap.ar_ihdr.it_len = sizeof(sc->sc_rxtapu);
852 	sc->sc_rxtap.ar_ihdr.it_present = ATW_RX_RADIOTAP_PRESENT;
853 
854 	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
855 	sc->sc_txtap.at_ihdr.it_len = sizeof(sc->sc_txtapu);
856 	sc->sc_txtap.at_ihdr.it_present = ATW_TX_RADIOTAP_PRESENT;
857 
858 	return;
859 
860 	/*
861 	 * Free any resources we've allocated during the failed attach
862 	 * attempt.  Do this in reverse order and fall through.
863 	 */
864  fail_5:
865 	for (i = 0; i < ATW_NRXDESC; i++) {
866 		if (sc->sc_rxsoft[i].rxs_dmamap == NULL)
867 			continue;
868 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_rxsoft[i].rxs_dmamap);
869 	}
870  fail_4:
871 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
872 		if (sc->sc_txsoft[i].txs_dmamap == NULL)
873 			continue;
874 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_txsoft[i].txs_dmamap);
875 	}
876 	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
877  fail_3:
878 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
879  fail_2:
880 	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_control_data,
881 	    sizeof(struct atw_control_data));
882  fail_1:
883 	bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
884  fail_0:
885 	return;
886 }
887 
888 struct ieee80211_node *
889 atw_node_alloc(struct ieee80211com *ic)
890 {
891 	struct atw_softc *sc = (struct atw_softc *)ic->ic_if.if_softc;
892 	struct ieee80211_node *ni = (*sc->sc_node_alloc)(ic);
893 
894 	DPRINTF(sc, ("%s: alloc node %p\n", sc->sc_dev.dv_xname, ni));
895 	return ni;
896 }
897 
898 void
899 atw_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
900 {
901 	struct atw_softc *sc = (struct atw_softc *)ic->ic_if.if_softc;
902 
903 	DPRINTF(sc, ("%s: freeing node %p %s\n", sc->sc_dev.dv_xname, ni,
904 	    ether_sprintf(ni->ni_bssid)));
905 	(*sc->sc_node_free)(ic, ni);
906 }
907 
908 
909 static void
910 atw_test1_reset(struct atw_softc *sc)
911 {
912 	switch (sc->sc_rev) {
913 	case ATW_REVISION_BA:
914 		if (1 /* XXX condition on transceiver type */) {
915 			ATW_SET(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MONITOR);
916 		}
917 		break;
918 	case ATW_REVISION_CA:
919 		ATW_CLR(sc, ATW_TEST1, ATW_TEST1_TESTMODE_MASK);
920 		break;
921 	default:
922 		break;
923 	}
924 }
925 
926 /*
927  * atw_reset:
928  *
929  *	Perform a soft reset on the ADM8211.
930  */
931 void
932 atw_reset(struct atw_softc *sc)
933 {
934 	int i;
935 	uint32_t lpc;
936 
937 	ATW_WRITE(sc, ATW_NAR, 0x0);
938 	DELAY(20 * 1000);
939 
940 	/* Reference driver has a cryptic remark indicating that this might
941 	 * power-on the chip.  I know that it turns off power-saving....
942 	 */
943 	ATW_WRITE(sc, ATW_FRCTL, 0x0);
944 
945 	ATW_WRITE(sc, ATW_PAR, ATW_PAR_SWR);
946 
947 	for (i = 0; i < 50; i++) {
948 		if (ATW_READ(sc, ATW_PAR) == 0)
949 			break;
950 		DELAY(1000);
951 	}
952 
953 	/* ... and then pause 100ms longer for good measure. */
954 	DELAY(100 * 1000);
955 
956 	DPRINTF2(sc, ("%s: atw_reset %d iterations\n", sc->sc_dev.dv_xname, i));
957 
958 	if (ATW_ISSET(sc, ATW_PAR, ATW_PAR_SWR))
959 		printf("%s: reset failed to complete\n", sc->sc_dev.dv_xname);
960 
961 	atw_test1_reset(sc);
962 	/*
963 	 * Initialize the PCI Access Register.
964 	 */
965 	sc->sc_busmode = ATW_PAR_PBL_8DW;
966 
967 	ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
968 	DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", sc->sc_dev.dv_xname,
969 	    ATW_READ(sc, ATW_PAR), sc->sc_busmode));
970 
971 	/* Turn off maximum power saving, etc.
972 	 *
973 	 * XXX Following example of reference driver, should I set
974 	 * an AID of 1?  It didn't seem to help....
975 	 */
976 	ATW_WRITE(sc, ATW_FRCTL, 0x0);
977 
978 	DELAY(100 * 1000);
979 
980 	/* Recall EEPROM. */
981 	ATW_SET(sc, ATW_TEST0, ATW_TEST0_EPRLD);
982 
983 	DELAY(10 * 1000);
984 
985 	lpc = ATW_READ(sc, ATW_LPC);
986 
987 	DPRINTF(sc, ("%s: ATW_LPC %#08x\n", __func__, lpc));
988 
989 	/* A reset seems to affect the SRAM contents, so put them into
990 	 * a known state.
991 	 */
992 	atw_clear_sram(sc);
993 
994 	memset(sc->sc_bssid, 0xff, sizeof(sc->sc_bssid));
995 }
996 
997 void
998 atw_clear_sram(struct atw_softc *sc)
999 {
1000 	memset(sc->sc_sram, 0, sizeof(sc->sc_sram));
1001 	/* XXX not for revision 0x20. */
1002 	atw_write_sram(sc, 0, sc->sc_sram, sc->sc_sramlen);
1003 }
1004 
1005 /* TBD atw_init
1006  *
1007  * set MAC based on ic->ic_bss->myaddr
1008  * write WEP keys
1009  * set TX rate
1010  */
1011 
1012 /* Tell the ADM8211 to raise ATW_INTR_LINKOFF if 7 beacon intervals pass
1013  * without receiving a beacon with the preferred BSSID & SSID.
1014  * atw_write_bssid & atw_write_ssid set the BSSID & SSID.
1015  */
1016 void
1017 atw_wcsr_init(struct atw_softc *sc)
1018 {
1019 	uint32_t wcsr;
1020 
1021 	wcsr = ATW_READ(sc, ATW_WCSR);
1022 	wcsr &= ~(ATW_WCSR_BLN_MASK|ATW_WCSR_LSOE|ATW_WCSR_MPRE|ATW_WCSR_LSOE);
1023 	wcsr |= LSHIFT(7, ATW_WCSR_BLN_MASK);
1024 	ATW_WRITE(sc, ATW_WCSR, wcsr);	/* XXX resets wake-up status bits */
1025 
1026 	DPRINTF(sc, ("%s: %s reg[WCSR] = %08x\n",
1027 	    sc->sc_dev.dv_xname, __func__, ATW_READ(sc, ATW_WCSR)));
1028 }
1029 
1030 /* Turn off power management.  Set Rx store-and-forward mode. */
1031 void
1032 atw_cmdr_init(struct atw_softc *sc)
1033 {
1034 	uint32_t cmdr;
1035 	cmdr = ATW_READ(sc, ATW_CMDR);
1036 	cmdr &= ~ATW_CMDR_APM;
1037 	cmdr |= ATW_CMDR_RTE;
1038 	cmdr &= ~ATW_CMDR_DRT_MASK;
1039 	cmdr |= ATW_CMDR_DRT_SF;
1040 
1041 	ATW_WRITE(sc, ATW_CMDR, cmdr);
1042 }
1043 
1044 void
1045 atw_tofs2_init(struct atw_softc *sc)
1046 {
1047 	uint32_t tofs2;
1048 	/* XXX this magic can probably be figured out from the RFMD docs */
1049 #ifndef ATW_REFSLAVE
1050 	tofs2 = LSHIFT(4, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
1051 	      LSHIFT(13, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
1052 	      LSHIFT(8, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
1053 	      LSHIFT(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
1054 	      LSHIFT(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
1055 	      LSHIFT(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
1056 	      LSHIFT(4, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
1057 	      LSHIFT(5, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
1058 #else
1059 	/* XXX new magic from reference driver source */
1060 	tofs2 = LSHIFT(8, ATW_TOFS2_PWR1UP_MASK)    | /* 8 ms = 4 * 2 ms */
1061 	      LSHIFT(8, ATW_TOFS2_PWR0PAPE_MASK) | /* 13 us */
1062 	      LSHIFT(1, ATW_TOFS2_PWR1PAPE_MASK)  | /* 8 us */
1063 	      LSHIFT(5, ATW_TOFS2_PWR0TRSW_MASK)  | /* 5 us */
1064 	      LSHIFT(12, ATW_TOFS2_PWR1TRSW_MASK) | /* 12 us */
1065 	      LSHIFT(13, ATW_TOFS2_PWR0PE2_MASK)  | /* 13 us */
1066 	      LSHIFT(1, ATW_TOFS2_PWR1PE2_MASK)   | /* 4 us */
1067 	      LSHIFT(8, ATW_TOFS2_PWR0TXPE_MASK);  /* 5 us */
1068 #endif
1069 	ATW_WRITE(sc, ATW_TOFS2, tofs2);
1070 }
1071 
1072 void
1073 atw_nar_init(struct atw_softc *sc)
1074 {
1075 	ATW_WRITE(sc, ATW_NAR, ATW_NAR_SF|ATW_NAR_PB);
1076 }
1077 
1078 void
1079 atw_txlmt_init(struct atw_softc *sc)
1080 {
1081 	ATW_WRITE(sc, ATW_TXLMT, LSHIFT(512, ATW_TXLMT_MTMLT_MASK) |
1082 	                         LSHIFT(1, ATW_TXLMT_SRTYLIM_MASK));
1083 }
1084 
1085 void
1086 atw_test1_init(struct atw_softc *sc)
1087 {
1088 	uint32_t test1;
1089 
1090 	test1 = ATW_READ(sc, ATW_TEST1);
1091 	test1 &= ~(ATW_TEST1_DBGREAD_MASK|ATW_TEST1_CONTROL);
1092 	/* XXX magic 0x1 */
1093 	test1 |= LSHIFT(0x1, ATW_TEST1_DBGREAD_MASK) | ATW_TEST1_CONTROL;
1094 	ATW_WRITE(sc, ATW_TEST1, test1);
1095 }
1096 
1097 void
1098 atw_rf_reset(struct atw_softc *sc)
1099 {
1100 	/* XXX this resets an Intersil RF front-end? */
1101 	/* TBD condition on Intersil RFType? */
1102 	ATW_WRITE(sc, ATW_SYNRF, ATW_SYNRF_INTERSIL_EN);
1103 	DELAY(10 * 1000);
1104 	ATW_WRITE(sc, ATW_SYNRF, 0);
1105 	DELAY(5 * 1000);
1106 }
1107 
1108 /* Set 16 TU max duration for the contention-free period (CFP). */
1109 void
1110 atw_cfp_init(struct atw_softc *sc)
1111 {
1112 	uint32_t cfpp;
1113 
1114 	cfpp = ATW_READ(sc, ATW_CFPP);
1115 	cfpp &= ~ATW_CFPP_CFPMD;
1116 	cfpp |= LSHIFT(16, ATW_CFPP_CFPMD);
1117 	ATW_WRITE(sc, ATW_CFPP, cfpp);
1118 }
1119 
1120 void
1121 atw_tofs0_init(struct atw_softc *sc)
1122 {
1123 	/* XXX I guess that the Cardbus clock is 22MHz?
1124 	 * I am assuming that the role of ATW_TOFS0_USCNT is
1125 	 * to divide the bus clock to get a 1MHz clock---the datasheet is not
1126 	 * very clear on this point. It says in the datasheet that it is
1127 	 * possible for the ADM8211 to accomodate bus speeds between 22MHz
1128 	 * and 33MHz; maybe this is the way? I see a binary-only driver write
1129 	 * these values. These values are also the power-on default.
1130 	 */
1131 	ATW_WRITE(sc, ATW_TOFS0,
1132 	    LSHIFT(22, ATW_TOFS0_USCNT_MASK) |
1133 	    ATW_TOFS0_TUCNT_MASK /* set all bits in TUCNT */);
1134 }
1135 
1136 /* Initialize interframe spacing: 802.11b slot time, SIFS, DIFS, EIFS. */
1137 void
1138 atw_ifs_init(struct atw_softc *sc)
1139 {
1140 	uint32_t ifst;
1141 	/* XXX EIFS=0x64, SIFS=110 are used by the reference driver.
1142 	 * Go figure.
1143 	 */
1144 	ifst = LSHIFT(IEEE80211_DUR_DS_SLOT, ATW_IFST_SLOT_MASK) |
1145 	    LSHIFT(22 * 5 /* IEEE80211_DUR_DS_SIFS */ /* # of 22MHz cycles */,
1146 		   ATW_IFST_SIFS_MASK) |
1147 	    LSHIFT(IEEE80211_DUR_DS_DIFS, ATW_IFST_DIFS_MASK) |
1148 	    LSHIFT(0x64 /* IEEE80211_DUR_DS_EIFS */, ATW_IFST_EIFS_MASK);
1149 
1150 	ATW_WRITE(sc, ATW_IFST, ifst);
1151 }
1152 
1153 void
1154 atw_response_times_init(struct atw_softc *sc)
1155 {
1156 	/* XXX More magic. Relates to ACK timing?  The datasheet seems to
1157 	 * indicate that the MAC expects at least SIFS + MIRT microseconds
1158 	 * to pass after it transmits a frame that requires a response;
1159 	 * it waits at most SIFS + MART microseconds for the response.
1160 	 * Surely this is not the ACK timeout?
1161 	 */
1162 	ATW_WRITE(sc, ATW_RSPT, LSHIFT(0xffff, ATW_RSPT_MART_MASK) |
1163 	    LSHIFT(0xff, ATW_RSPT_MIRT_MASK));
1164 }
1165 
1166 /* Set up the MMI read/write addresses for the baseband. The Tx/Rx
1167  * engines read and write baseband registers after Rx and before
1168  * Tx, respectively.
1169  */
1170 void
1171 atw_bbp_io_init(struct atw_softc *sc)
1172 {
1173 	uint32_t mmiraddr2;
1174 
1175 	/* XXX The reference driver does this, but is it *really*
1176 	 * necessary?
1177 	 */
1178 	switch (sc->sc_rev) {
1179 	case ATW_REVISION_AB:
1180 	case ATW_REVISION_AF:
1181 		mmiraddr2 = 0x0;
1182 		break;
1183 	default:
1184 		mmiraddr2 = ATW_READ(sc, ATW_MMIRADDR2);
1185 		mmiraddr2 &=
1186 		    ~(ATW_MMIRADDR2_PROREXT|ATW_MMIRADDR2_PRORLEN_MASK);
1187 		break;
1188 	}
1189 
1190 	switch (sc->sc_bbptype) {
1191 	case ATW_BBPTYPE_INTERSIL:
1192 		ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_INTERSIL);
1193 		ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_INTERSIL);
1194 		mmiraddr2 |= ATW_MMIRADDR2_INTERSIL;
1195 		break;
1196 	case ATW_BBPTYPE_MARVEL:
1197 		/* TBD find out the Marvel settings. */
1198 		break;
1199 	case ATW_BBPTYPE_RFMD:
1200 	default:
1201 		ATW_WRITE(sc, ATW_MMIWADDR, ATW_MMIWADDR_RFMD);
1202 		ATW_WRITE(sc, ATW_MMIRADDR1, ATW_MMIRADDR1_RFMD);
1203 		mmiraddr2 |= ATW_MMIRADDR2_RFMD;
1204 		break;
1205 	}
1206 	ATW_WRITE(sc, ATW_MMIRADDR2, mmiraddr2);
1207 
1208 	atw_si4126_init(sc);
1209 
1210 	ATW_WRITE(sc, ATW_MACTEST, ATW_MACTEST_MMI_USETXCLK);
1211 }
1212 
1213 void
1214 atw_si4126_init(struct atw_softc *sc)
1215 {
1216 	switch (sc->sc_rftype) {
1217 	case ATW_RFTYPE_RFMD:
1218 		if (sc->sc_rev >= ATW_REVISION_BA) {
1219 			atw_si4126_write(sc, 0x1f, 0x00000);
1220 			atw_si4126_write(sc, 0x0c, 0x3001f);
1221 			atw_si4126_write(sc, SI4126_GAIN, 0x29c03);
1222 			atw_si4126_write(sc, SI4126_RF1N, 0x1ff6f);
1223 			atw_si4126_write(sc, SI4126_RF2N, 0x29403);
1224 			atw_si4126_write(sc, SI4126_RF2R, 0x1456f);
1225 			atw_si4126_write(sc, 0x09, 0x10050);
1226 			atw_si4126_write(sc, SI4126_IFR, 0x3fff8);
1227 		}
1228 		break;
1229 	default:
1230 		break;
1231 	}
1232 }
1233 
1234 /*
1235  * atw_init:		[ ifnet interface function ]
1236  *
1237  *	Initialize the interface.  Must be called at splnet().
1238  */
1239 int
1240 atw_init(struct ifnet *ifp)
1241 {
1242 	struct atw_softc *sc = ifp->if_softc;
1243 	struct ieee80211com *ic = &sc->sc_ic;
1244 	struct atw_txsoft *txs;
1245 	struct atw_rxsoft *rxs;
1246 	int i, error = 0;
1247 
1248 	if ((error = atw_enable(sc)) != 0)
1249 		goto out;
1250 
1251 	/*
1252 	 * Cancel any pending I/O. This also resets.
1253 	 */
1254 	atw_stop(ifp, 0);
1255 
1256 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
1257 	DPRINTF(sc, ("%s: channel %d freq %d flags 0x%04x\n",
1258 	    __func__, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan),
1259 	    ic->ic_bss->ni_chan->ic_freq, ic->ic_bss->ni_chan->ic_flags));
1260 
1261 	atw_wcsr_init(sc);
1262 
1263 	atw_cmdr_init(sc);
1264 
1265 	/* Set data rate for PLCP Signal field, 1Mbps = 10 x 100Kb/s.
1266 	 *
1267 	 * XXX Set transmit power for ATIM, RTS, Beacon.
1268 	 */
1269 	ATW_WRITE(sc, ATW_PLCPHD, LSHIFT(10, ATW_PLCPHD_SIGNAL_MASK) |
1270 	    LSHIFT(0xb0, ATW_PLCPHD_SERVICE_MASK));
1271 
1272 	atw_tofs2_init(sc);
1273 
1274 	atw_nar_init(sc);
1275 
1276 	atw_txlmt_init(sc);
1277 
1278 	atw_test1_init(sc);
1279 
1280 	atw_rf_reset(sc);
1281 
1282 	atw_cfp_init(sc);
1283 
1284 	atw_tofs0_init(sc);
1285 
1286 	atw_ifs_init(sc);
1287 
1288 	/* XXX Fall asleep after one second of inactivity.
1289 	 * XXX A frame may only dribble in for 65536us.
1290 	 */
1291 	ATW_WRITE(sc, ATW_RMD,
1292 	    LSHIFT(1, ATW_RMD_PCNT) | LSHIFT(0xffff, ATW_RMD_RMRD_MASK));
1293 
1294 	atw_response_times_init(sc);
1295 
1296 	atw_bbp_io_init(sc);
1297 
1298 	ATW_WRITE(sc, ATW_STSR, 0xffffffff);
1299 
1300 	if ((error = atw_rf3000_init(sc)) != 0)
1301 		goto out;
1302 
1303 	ATW_WRITE(sc, ATW_PAR, sc->sc_busmode);
1304 	DPRINTF(sc, ("%s: ATW_PAR %08x busmode %08x\n", sc->sc_dev.dv_xname,
1305 	    ATW_READ(sc, ATW_PAR), sc->sc_busmode));
1306 
1307 	/*
1308 	 * Initialize the transmit descriptor ring.
1309 	 */
1310 	memset(sc->sc_txdescs, 0, sizeof(sc->sc_txdescs));
1311 	for (i = 0; i < ATW_NTXDESC; i++) {
1312 		sc->sc_txdescs[i].at_ctl = 0;
1313 		/* no transmit chaining */
1314 		sc->sc_txdescs[i].at_flags = 0 /* ATW_TXFLAG_TCH */;
1315 		sc->sc_txdescs[i].at_buf2 =
1316 		    htole32(ATW_CDTXADDR(sc, ATW_NEXTTX(i)));
1317 	}
1318 	/* use ring mode */
1319 	sc->sc_txdescs[ATW_NTXDESC - 1].at_flags |= htole32(ATW_TXFLAG_TER);
1320 	ATW_CDTXSYNC(sc, 0, ATW_NTXDESC,
1321 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1322 	sc->sc_txfree = ATW_NTXDESC;
1323 	sc->sc_txnext = 0;
1324 
1325 	/*
1326 	 * Initialize the transmit job descriptors.
1327 	 */
1328 	SIMPLEQ_INIT(&sc->sc_txfreeq);
1329 	SIMPLEQ_INIT(&sc->sc_txdirtyq);
1330 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
1331 		txs = &sc->sc_txsoft[i];
1332 		txs->txs_mbuf = NULL;
1333 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
1334 	}
1335 
1336 	/*
1337 	 * Initialize the receive descriptor and receive job
1338 	 * descriptor rings.
1339 	 */
1340 	for (i = 0; i < ATW_NRXDESC; i++) {
1341 		rxs = &sc->sc_rxsoft[i];
1342 		if (rxs->rxs_mbuf == NULL) {
1343 			if ((error = atw_add_rxbuf(sc, i)) != 0) {
1344 				printf("%s: unable to allocate or map rx "
1345 				    "buffer %d, error = %d\n",
1346 				    sc->sc_dev.dv_xname, i, error);
1347 				/*
1348 				 * XXX Should attempt to run with fewer receive
1349 				 * XXX buffers instead of just failing.
1350 				 */
1351 				atw_rxdrain(sc);
1352 				goto out;
1353 			}
1354 		} else
1355 			ATW_INIT_RXDESC(sc, i);
1356 	}
1357 	sc->sc_rxptr = 0;
1358 
1359 	/*
1360 	 * Initialize the interrupt mask and enable interrupts.
1361 	 */
1362 	/* normal interrupts */
1363 	sc->sc_inten =  ATW_INTR_TCI | ATW_INTR_TDU | ATW_INTR_RCI |
1364 	    ATW_INTR_NISS | ATW_INTR_LINKON | ATW_INTR_BCNTC;
1365 
1366 	/* abnormal interrupts */
1367 	sc->sc_inten |= ATW_INTR_TPS | ATW_INTR_TLT | ATW_INTR_TRT |
1368 	    ATW_INTR_TUF | ATW_INTR_RDU | ATW_INTR_RPS | ATW_INTR_AISS |
1369 	    ATW_INTR_FBE | ATW_INTR_LINKOFF | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
1370 
1371 	sc->sc_linkint_mask = ATW_INTR_LINKON | ATW_INTR_LINKOFF |
1372 	    ATW_INTR_BCNTC | ATW_INTR_TSFTF | ATW_INTR_TSCZ;
1373 	sc->sc_rxint_mask = ATW_INTR_RCI | ATW_INTR_RDU;
1374 	sc->sc_txint_mask = ATW_INTR_TCI | ATW_INTR_TUF | ATW_INTR_TLT |
1375 	    ATW_INTR_TRT;
1376 
1377 	sc->sc_linkint_mask &= sc->sc_inten;
1378 	sc->sc_rxint_mask &= sc->sc_inten;
1379 	sc->sc_txint_mask &= sc->sc_inten;
1380 
1381 	ATW_WRITE(sc, ATW_IER, sc->sc_inten);
1382 	ATW_WRITE(sc, ATW_STSR, 0xffffffff);
1383 
1384 	DPRINTF(sc, ("%s: ATW_IER %08x, inten %08x\n",
1385 	    sc->sc_dev.dv_xname, ATW_READ(sc, ATW_IER), sc->sc_inten));
1386 
1387 	/*
1388 	 * Give the transmit and receive rings to the ADM8211.
1389 	 */
1390 	ATW_WRITE(sc, ATW_RDB, ATW_CDRXADDR(sc, sc->sc_rxptr));
1391 	ATW_WRITE(sc, ATW_TDBD, ATW_CDTXADDR(sc, sc->sc_txnext));
1392 
1393 	sc->sc_txthresh = 0;
1394 	sc->sc_opmode = ATW_NAR_SR | ATW_NAR_ST |
1395 	    sc->sc_txth[sc->sc_txthresh].txth_opmode;
1396 
1397 	/* common 802.11 configuration */
1398 	ic->ic_flags &= ~IEEE80211_F_IBSSON;
1399 	switch (ic->ic_opmode) {
1400 	case IEEE80211_M_STA:
1401 		break;
1402 #ifndef IEEE80211_STA_ONLY
1403 	case IEEE80211_M_AHDEMO: /* XXX */
1404 	case IEEE80211_M_IBSS:
1405 		ic->ic_flags |= IEEE80211_F_IBSSON;
1406 		/*FALLTHROUGH*/
1407 #endif
1408 	default: /* XXX */
1409 		break;
1410 	}
1411 
1412 #ifndef IEEE80211_STA_ONLY
1413 	switch (ic->ic_opmode) {
1414 	case IEEE80211_M_AHDEMO:
1415 		ic->ic_bss->ni_intval = ic->ic_lintval;
1416 		ic->ic_bss->ni_rssi = 0;
1417 		ic->ic_bss->ni_rstamp = 0;
1418 		break;
1419 	default:					/* XXX */
1420 		break;
1421 	}
1422 #endif
1423 	sc->sc_wepctl = 0;
1424 
1425 	atw_write_ssid(sc);
1426 	atw_write_sup_rates(sc);
1427 	if (ic->ic_caps & IEEE80211_C_WEP)
1428 		atw_write_wep(sc);
1429 
1430 	ic->ic_state = IEEE80211_S_INIT;
1431 
1432 	/*
1433 	 * Set the receive filter.  This will start the transmit and
1434 	 * receive processes.
1435 	 */
1436 	atw_filter_setup(sc);
1437 
1438 	/*
1439 	 * Start the receive process.
1440 	 */
1441 	ATW_WRITE(sc, ATW_RDR, 0x1);
1442 
1443 	/*
1444 	 * Note that the interface is now running.
1445 	 */
1446 	ifp->if_flags |= IFF_RUNNING;
1447 	ifp->if_flags &= ~IFF_OACTIVE;
1448 
1449 	/* send no beacons, yet. */
1450 	atw_start_beacon(sc, 0);
1451 
1452 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
1453 		error = ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1454 	else
1455 		error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1456  out:
1457 	if (error) {
1458 		ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1459 		ifp->if_timer = 0;
1460 		printf("%s: interface not running\n", sc->sc_dev.dv_xname);
1461 	}
1462 #ifdef ATW_DEBUG
1463 	atw_print_regs(sc, "end of init");
1464 #endif /* ATW_DEBUG */
1465 
1466 	return (error);
1467 }
1468 
1469 /* enable == 1: host control of RF3000/Si4126 through ATW_SYNCTL.
1470  *           0: MAC control of RF3000/Si4126.
1471  *
1472  * Applies power, or selects RF front-end? Sets reset condition.
1473  *
1474  * TBD support non-RFMD BBP, non-SiLabs synth.
1475  */
1476 void
1477 atw_bbp_io_enable(struct atw_softc *sc, int enable)
1478 {
1479 	if (enable) {
1480 		ATW_WRITE(sc, ATW_SYNRF,
1481 		    ATW_SYNRF_SELRF|ATW_SYNRF_PE1|ATW_SYNRF_PHYRST);
1482 		DELAY(atw_bbp_io_enable_delay);
1483 	} else {
1484 		ATW_WRITE(sc, ATW_SYNRF, 0);
1485 		DELAY(atw_bbp_io_disable_delay); /* shorter for some reason */
1486 	}
1487 }
1488 
1489 int
1490 atw_tune(struct atw_softc *sc)
1491 {
1492 	int rc;
1493 	u_int chan;
1494 	struct ieee80211com *ic = &sc->sc_ic;
1495 
1496 	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
1497 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1498 		return 0;
1499 
1500 	if (chan == sc->sc_cur_chan)
1501 		return 0;
1502 
1503 	DPRINTF(sc, ("%s: chan %d -> %d\n", sc->sc_dev.dv_xname,
1504 	    sc->sc_cur_chan, chan));
1505 
1506 	atw_idle(sc, ATW_NAR_SR|ATW_NAR_ST);
1507 
1508 	atw_si4126_tune(sc, chan);
1509 	if ((rc = atw_rf3000_tune(sc, chan)) != 0)
1510 		printf("%s: failed to tune channel %d\n", sc->sc_dev.dv_xname,
1511 		    chan);
1512 
1513 	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
1514 	DELAY(20 * 1000);
1515 	ATW_WRITE(sc, ATW_RDR, 0x1);
1516 
1517 	if (rc == 0)
1518 		sc->sc_cur_chan = chan;
1519 
1520 	return rc;
1521 }
1522 
1523 #ifdef ATW_SYNDEBUG
1524 void
1525 atw_si4126_print(struct atw_softc *sc)
1526 {
1527 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1528 	u_int addr, val;
1529 
1530 	if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
1531 		return;
1532 
1533 	for (addr = 0; addr <= 8; addr++) {
1534 		printf("%s: synth[%d] = ", sc->sc_dev.dv_xname, addr);
1535 		if (atw_si4126_read(sc, addr, &val) == 0) {
1536 			printf("<unknown> (quitting print-out)\n");
1537 			break;
1538 		}
1539 		printf("%05x\n", val);
1540 	}
1541 }
1542 #endif /* ATW_SYNDEBUG */
1543 
1544 /* Tune to channel chan by adjusting the Si4126 RF/IF synthesizer.
1545  *
1546  * The RF/IF synthesizer produces two reference frequencies for
1547  * the RF2948B transceiver.  The first frequency the RF2948B requires
1548  * is two times the so-called "intermediate frequency" (IF). Since
1549  * a SAW filter on the radio fixes the IF at 374MHz, I program the
1550  * Si4126 to generate IF LO = 374MHz x 2 = 748MHz.  The second
1551  * frequency required by the transceiver is the radio frequency
1552  * (RF). This is a superheterodyne transceiver; for f(chan) the
1553  * center frequency of the channel we are tuning, RF = f(chan) -
1554  * IF.
1555  *
1556  * XXX I am told by SiLabs that the Si4126 will accept a broader range
1557  * of XIN than the 2-25MHz mentioned by the datasheet, even *without*
1558  * XINDIV2 = 1.  I've tried this (it is necessary to double R) and it
1559  * works, but I have still programmed for XINDIV2 = 1 to be safe.
1560  */
1561 void
1562 atw_si4126_tune(struct atw_softc *sc, u_int chan)
1563 {
1564 	u_int mhz;
1565 	u_int R;
1566 	u_int32_t gpio;
1567 	u_int16_t gain;
1568 
1569 #ifdef ATW_SYNDEBUG
1570 	atw_si4126_print(sc);
1571 #endif /* ATW_SYNDEBUG */
1572 
1573 	if (sc->sc_rev >= ATW_REVISION_BA) {
1574 		atw_si4126_write(sc, SI4126_MAIN, 0x04007);
1575 		atw_si4126_write(sc, SI4126_POWER, 0x00033);
1576 		atw_si4126_write(sc, SI4126_IFN,
1577 		    atw_rfmd2958_ifn[chan - 1]);
1578 		atw_si4126_write(sc, SI4126_RF1R,
1579 		    atw_rfmd2958_rf1r[chan - 1]);
1580 #ifdef NOTYET
1581 		/* set TX POWER? */
1582 		atw_si4126_write(sc, 0x0a,
1583 		    (sc->sc_srom[ATW_SR_CSR20] & mask) |
1584 		    power << 9);
1585 #endif
1586 		/* set TX GAIN */
1587 		atw_si4126_write(sc, 0x09, 0x00050 |
1588 		    sc->sc_srom[ATW_SR_TXPOWER(chan - 1)]);
1589 		/* wait 100us from power-up for RF, IF to settle */
1590 		DELAY(100);
1591 
1592 		return;
1593 	}
1594 
1595 	if (chan == 14)
1596 		mhz = 2484;
1597 	else
1598 		mhz = 2412 + 5 * (chan - 1);
1599 
1600 	/* Tune IF to 748MHz to suit the IF LO input of the
1601 	 * RF2494B, which is 2 x IF. No need to set an IF divider
1602          * because an IF in 526MHz - 952MHz is allowed.
1603 	 *
1604 	 * XIN is 44.000MHz, so divide it by two to get allowable
1605 	 * range of 2-25MHz. SiLabs tells me that this is not
1606 	 * strictly necessary.
1607 	 */
1608 
1609 	if (atw_xindiv2)
1610 		R = 44;
1611 	else
1612 		R = 88;
1613 
1614 	/* Power-up RF, IF synthesizers. */
1615 	atw_si4126_write(sc, SI4126_POWER,
1616 	    SI4126_POWER_PDIB|SI4126_POWER_PDRB);
1617 
1618 	/* set LPWR, too? */
1619 	atw_si4126_write(sc, SI4126_MAIN,
1620 	    (atw_xindiv2) ? SI4126_MAIN_XINDIV2 : 0);
1621 
1622 	/* Set the phase-locked loop gain.  If RF2 N > 2047, then
1623 	 * set KP2 to 1.
1624 	 *
1625 	 * REFDIF This is different from the reference driver, which
1626 	 * always sets SI4126_GAIN to 0.
1627 	 */
1628 	gain = LSHIFT(((mhz - 374) > 2047) ? 1 : 0, SI4126_GAIN_KP2_MASK);
1629 
1630 	atw_si4126_write(sc, SI4126_GAIN, gain);
1631 
1632 	/* XIN = 44MHz.
1633 	 *
1634 	 * If XINDIV2 = 1, IF = N/(2 * R) * XIN.  I choose N = 1496,
1635 	 * R = 44 so that 1496/(2 * 44) * 44MHz = 748MHz.
1636 	 *
1637 	 * If XINDIV2 = 0, IF = N/R * XIN.  I choose N = 1496, R = 88
1638 	 * so that 1496/88 * 44MHz = 748MHz.
1639 	 */
1640 	atw_si4126_write(sc, SI4126_IFN, 1496);
1641 
1642 	atw_si4126_write(sc, SI4126_IFR, R);
1643 
1644 #ifndef ATW_REFSLAVE
1645 	/* Set RF1 arbitrarily. DO NOT configure RF1 after RF2, because
1646 	 * then RF1 becomes the active RF synthesizer, even on the Si4126,
1647 	 * which has no RF1!
1648 	 */
1649 	atw_si4126_write(sc, SI4126_RF1R, R);
1650 
1651 	atw_si4126_write(sc, SI4126_RF1N, mhz - 374);
1652 #endif
1653 
1654 	/* N/R * XIN = RF. XIN = 44MHz. We desire RF = mhz - IF,
1655 	 * where IF = 374MHz.  Let's divide XIN to 1MHz. So R = 44.
1656 	 * Now let's multiply it to mhz. So mhz - IF = N.
1657 	 */
1658 	atw_si4126_write(sc, SI4126_RF2R, R);
1659 
1660 	atw_si4126_write(sc, SI4126_RF2N, mhz - 374);
1661 
1662 	/* wait 100us from power-up for RF, IF to settle */
1663 	DELAY(100);
1664 
1665 	gpio = ATW_READ(sc, ATW_GPIO);
1666 	gpio &= ~(ATW_GPIO_EN_MASK|ATW_GPIO_O_MASK|ATW_GPIO_I_MASK);
1667 	gpio |= LSHIFT(1, ATW_GPIO_EN_MASK);
1668 
1669 	if ((sc->sc_if.if_flags & IFF_LINK1) != 0 && chan != 14) {
1670 		/* Set a Prism RF front-end to a special mode for channel 14?
1671 		 *
1672 		 * Apparently the SMC2635W needs this, although I don't think
1673 		 * it has a Prism RF.
1674 		 */
1675 		gpio |= LSHIFT(1, ATW_GPIO_O_MASK);
1676 	}
1677 	ATW_WRITE(sc, ATW_GPIO, gpio);
1678 
1679 #ifdef ATW_SYNDEBUG
1680 	atw_si4126_print(sc);
1681 #endif /* ATW_SYNDEBUG */
1682 }
1683 
1684 /* Baseline initialization of RF3000 BBP: set CCA mode and enable antenna
1685  * diversity.
1686  *
1687  * !!!
1688  * !!! Call this w/ Tx/Rx suspended, atw_idle(, ATW_NAR_ST|ATW_NAR_SR).
1689  * !!!
1690  */
1691 int
1692 atw_rf3000_init(struct atw_softc *sc)
1693 {
1694 	int rc = 0;
1695 
1696 	atw_bbp_io_enable(sc, 1);
1697 
1698 	/* CCA is acquisition sensitive */
1699 	rc = atw_rf3000_write(sc, RF3000_CCACTL,
1700 	    LSHIFT(RF3000_CCACTL_MODE_BOTH, RF3000_CCACTL_MODE_MASK));
1701 
1702 	if (rc != 0)
1703 		goto out;
1704 
1705 	/* enable diversity */
1706 	rc = atw_rf3000_write(sc, RF3000_DIVCTL, RF3000_DIVCTL_ENABLE);
1707 
1708 	if (rc != 0)
1709 		goto out;
1710 
1711 	/* sensible setting from a binary-only driver */
1712 	rc = atw_rf3000_write(sc, RF3000_GAINCTL,
1713 	    LSHIFT(0x1d, RF3000_GAINCTL_TXVGC_MASK));
1714 
1715 	if (rc != 0)
1716 		goto out;
1717 
1718 	/* magic from a binary-only driver */
1719 	rc = atw_rf3000_write(sc, RF3000_LOGAINCAL,
1720 	    LSHIFT(0x38, RF3000_LOGAINCAL_CAL_MASK));
1721 
1722 	if (rc != 0)
1723 		goto out;
1724 
1725 	rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, RF3000_HIGAINCAL_DSSSPAD);
1726 
1727 	if (rc != 0)
1728 		goto out;
1729 
1730 	/*
1731 	 * XXX Reference driver remarks that Abocom sets this to 50.
1732 	 * Meaning 0x50, I think....  50 = 0x32, which would set a bit
1733 	 * in the "reserved" area of register RF3000_OPTIONS1.
1734 	 */
1735 	rc = atw_rf3000_write(sc, RF3000_OPTIONS1, sc->sc_rf3000_options1);
1736 
1737 	if (rc != 0)
1738 		goto out;
1739 
1740 	rc = atw_rf3000_write(sc, RF3000_OPTIONS2, sc->sc_rf3000_options2);
1741 
1742 	if (rc != 0)
1743 		goto out;
1744 
1745 out:
1746 	atw_bbp_io_enable(sc, 0);
1747 	return rc;
1748 }
1749 
1750 #ifdef ATW_BBPDEBUG
1751 void
1752 atw_rf3000_print(struct atw_softc *sc)
1753 {
1754 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1755 	u_int addr, val;
1756 
1757 	if (atw_debug < 3 || (ifp->if_flags & IFF_DEBUG) == 0)
1758 		return;
1759 
1760 	for (addr = 0x01; addr <= 0x15; addr++) {
1761 		printf("%s: bbp[%d] = \n", sc->sc_dev.dv_xname, addr);
1762 		if (atw_rf3000_read(sc, addr, &val) != 0) {
1763 			printf("<unknown> (quitting print-out)\n");
1764 			break;
1765 		}
1766 		printf("%08x\n", val);
1767 	}
1768 }
1769 #endif /* ATW_BBPDEBUG */
1770 
1771 /* Set the power settings on the BBP for channel `chan'. */
1772 int
1773 atw_rf3000_tune(struct atw_softc *sc, u_int chan)
1774 {
1775 	int rc = 0;
1776 	u_int32_t reg;
1777 	u_int16_t txpower, lpf_cutoff, lna_gs_thresh;
1778 
1779 	txpower = sc->sc_srom[ATW_SR_TXPOWER(chan)];
1780 	lpf_cutoff = sc->sc_srom[ATW_SR_LPF_CUTOFF(chan)];
1781 	lna_gs_thresh = sc->sc_srom[ATW_SR_LNA_GS_THRESH(chan)];
1782 
1783 	/* odd channels: LSB, even channels: MSB */
1784 	if (chan % 2 == 1) {
1785 		txpower &= 0xFF;
1786 		lpf_cutoff &= 0xFF;
1787 		lna_gs_thresh &= 0xFF;
1788 	} else {
1789 		txpower >>= 8;
1790 		lpf_cutoff >>= 8;
1791 		lna_gs_thresh >>= 8;
1792 	}
1793 
1794 #ifdef ATW_BBPDEBUG
1795 	atw_rf3000_print(sc);
1796 #endif /* ATW_BBPDEBUG */
1797 
1798 	DPRINTF(sc, ("%s: chan %d txpower %02x, lpf_cutoff %02x, "
1799 	    "lna_gs_thresh %02x\n",
1800 	    sc->sc_dev.dv_xname, chan, txpower, lpf_cutoff, lna_gs_thresh));
1801 
1802 	atw_bbp_io_enable(sc, 1);
1803 
1804 	if ((rc = atw_rf3000_write(sc, RF3000_GAINCTL,
1805 	    LSHIFT(txpower, RF3000_GAINCTL_TXVGC_MASK))) != 0)
1806 		goto out;
1807 
1808 	if ((rc = atw_rf3000_write(sc, RF3000_LOGAINCAL, lpf_cutoff)) != 0)
1809 		goto out;
1810 
1811 	if ((rc = atw_rf3000_write(sc, RF3000_HIGAINCAL, lna_gs_thresh)) != 0)
1812 		goto out;
1813 
1814 	if ((rc = atw_rf3000_write(sc, RF3000_OPTIONS1, 0x0)) != 0)
1815 		goto out;
1816 
1817 	rc = atw_rf3000_write(sc, RF3000_OPTIONS2, RF3000_OPTIONS2_LNAGS_DELAY);
1818 	if (rc != 0)
1819 		goto out;
1820 
1821 #ifdef ATW_BBPDEBUG
1822 	atw_rf3000_print(sc);
1823 #endif /* ATW_BBPDEBUG */
1824 
1825 out:
1826 	atw_bbp_io_enable(sc, 0);
1827 
1828 	/* set beacon, rts, atim transmit power */
1829 	reg = ATW_READ(sc, ATW_PLCPHD);
1830 	reg &= ~ATW_PLCPHD_SERVICE_MASK;
1831 	reg |= LSHIFT(LSHIFT(txpower, RF3000_GAINCTL_TXVGC_MASK),
1832 	    ATW_PLCPHD_SERVICE_MASK);
1833 	ATW_WRITE(sc, ATW_PLCPHD, reg);
1834 	DELAY(2 * 1000);
1835 
1836 	return rc;
1837 }
1838 
1839 /* Write a register on the RF3000 baseband processor using the
1840  * registers provided by the ADM8211 for this purpose.
1841  *
1842  * Return 0 on success.
1843  */
1844 int
1845 atw_rf3000_write(struct atw_softc *sc, u_int addr, u_int val)
1846 {
1847 	u_int32_t reg;
1848 	int i;
1849 
1850 	reg = sc->sc_bbpctl_wr |
1851 	     LSHIFT(val & 0xff, ATW_BBPCTL_DATA_MASK) |
1852 	     LSHIFT(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
1853 
1854 	for (i = 10; --i >= 0; ) {
1855 		ATW_WRITE(sc, ATW_BBPCTL, reg);
1856 		DELAY(2000);
1857 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_WR) == 0)
1858 			break;
1859 	}
1860 
1861 	if (i < 0) {
1862 		printf("%s: BBPCTL still busy\n", sc->sc_dev.dv_xname);
1863 		return ETIMEDOUT;
1864 	}
1865 	return 0;
1866 }
1867 
1868 /* Read a register on the RF3000 baseband processor using the registers
1869  * the ADM8211 provides for this purpose.
1870  *
1871  * The 7-bit register address is addr.  Record the 8-bit data in the register
1872  * in *val.
1873  *
1874  * Return 0 on success.
1875  *
1876  * XXX This does not seem to work. The ADM8211 must require more or
1877  * different magic to read the chip than to write it. Possibly some
1878  * of the magic I have derived from a binary-only driver concerns
1879  * the "chip address" (see the RF3000 manual).
1880  */
1881 #ifdef ATW_BBPDEBUG
1882 int
1883 atw_rf3000_read(struct atw_softc *sc, u_int addr, u_int *val)
1884 {
1885 	u_int32_t reg;
1886 	int i;
1887 
1888 	for (i = 1000; --i >= 0; ) {
1889 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD|ATW_BBPCTL_WR) == 0)
1890 			break;
1891 		DELAY(100);
1892 	}
1893 
1894 	if (i < 0) {
1895 		printf("%s: start atw_rf3000_read, BBPCTL busy\n",
1896 		    sc->sc_dev.dv_xname);
1897 		return ETIMEDOUT;
1898 	}
1899 
1900 	reg = sc->sc_bbpctl_rd | LSHIFT(addr & 0x7f, ATW_BBPCTL_ADDR_MASK);
1901 
1902 	ATW_WRITE(sc, ATW_BBPCTL, reg);
1903 
1904 	for (i = 1000; --i >= 0; ) {
1905 		DELAY(100);
1906 		if (ATW_ISSET(sc, ATW_BBPCTL, ATW_BBPCTL_RD) == 0)
1907 			break;
1908 	}
1909 
1910 	ATW_CLR(sc, ATW_BBPCTL, ATW_BBPCTL_RD);
1911 
1912 	if (i < 0) {
1913 		printf("%s: atw_rf3000_read wrote %08x; BBPCTL still busy\n",
1914 		    sc->sc_dev.dv_xname, reg);
1915 		return ETIMEDOUT;
1916 	}
1917 	if (val != NULL)
1918 		*val = MASK_AND_RSHIFT(reg, ATW_BBPCTL_DATA_MASK);
1919 	return 0;
1920 }
1921 #endif /* ATW_BBPDEBUG */
1922 
1923 /* Write a register on the Si4126 RF/IF synthesizer using the registers
1924  * provided by the ADM8211 for that purpose.
1925  *
1926  * val is 18 bits of data, and val is the 4-bit address of the register.
1927  *
1928  * Return 0 on success.
1929  */
1930 void
1931 atw_si4126_write(struct atw_softc *sc, u_int addr, u_int val)
1932 {
1933 	uint32_t bits, mask, reg;
1934 	int nbits;
1935 
1936 	if (sc->sc_rev >= ATW_REVISION_BA) {
1937 		nbits = 24;
1938 
1939 		val &= 0x3ffff;
1940 		addr &= 0x1f;
1941 		bits = val | (addr << 18);
1942 	} else {
1943 		nbits = 22;
1944 
1945 		KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
1946 		KASSERT((val & ~PRESHIFT(SI4126_TWI_DATA_MASK)) == 0);
1947 
1948 		bits = LSHIFT(val, SI4126_TWI_DATA_MASK) |
1949 		    LSHIFT(addr, SI4126_TWI_ADDR_MASK);
1950 	}
1951 
1952 	reg = ATW_SYNRF_SELSYN;
1953 	/* reference driver: reset Si4126 serial bus to initial
1954 	 * conditions?
1955 	 */
1956 	ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
1957 	ATW_WRITE(sc, ATW_SYNRF, reg);
1958 
1959 	for (mask = BIT(nbits - 1); mask != 0; mask >>= 1) {
1960 		if ((bits & mask) != 0)
1961 			reg |= ATW_SYNRF_SYNDATA;
1962 		else
1963 			reg &= ~ATW_SYNRF_SYNDATA;
1964 		ATW_WRITE(sc, ATW_SYNRF, reg);
1965 		ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_SYNCLK);
1966 		ATW_WRITE(sc, ATW_SYNRF, reg);
1967 	}
1968 	ATW_WRITE(sc, ATW_SYNRF, reg | ATW_SYNRF_LEIF);
1969 	ATW_WRITE(sc, ATW_SYNRF, 0x0);
1970 }
1971 
1972 /* Read 18-bit data from the 4-bit address addr in Si4126
1973  * RF synthesizer and write the data to *val. Return 0 on success.
1974  *
1975  * XXX This does not seem to work. The ADM8211 must require more or
1976  * different magic to read the chip than to write it.
1977  */
1978 #ifdef ATW_SYNDEBUG
1979 int
1980 atw_si4126_read(struct atw_softc *sc, u_int addr, u_int *val)
1981 {
1982 	u_int32_t reg;
1983 	int i;
1984 
1985 	KASSERT((addr & ~PRESHIFT(SI4126_TWI_ADDR_MASK)) == 0);
1986 
1987 	for (i = 1000; --i >= 0; ) {
1988 		if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD|ATW_SYNCTL_WR) == 0)
1989 			break;
1990 		DELAY(100);
1991 	}
1992 
1993 	if (i < 0) {
1994 		printf("%s: start atw_si4126_read, SYNCTL busy\n",
1995 		    sc->sc_dev.dv_xname);
1996 		return ETIMEDOUT;
1997 	}
1998 
1999 	reg = sc->sc_synctl_rd | LSHIFT(addr, ATW_SYNCTL_DATA_MASK);
2000 
2001 	ATW_WRITE(sc, ATW_SYNCTL, reg);
2002 
2003 	for (i = 1000; --i >= 0; ) {
2004 		DELAY(100);
2005 		if (ATW_ISSET(sc, ATW_SYNCTL, ATW_SYNCTL_RD) == 0)
2006 			break;
2007 	}
2008 
2009 	ATW_CLR(sc, ATW_SYNCTL, ATW_SYNCTL_RD);
2010 
2011 	if (i < 0) {
2012 		printf("%s: atw_si4126_read wrote %#08x, SYNCTL still busy\n",
2013 		    sc->sc_dev.dv_xname, reg);
2014 		return ETIMEDOUT;
2015 	}
2016 	if (val != NULL)
2017 		*val = MASK_AND_RSHIFT(ATW_READ(sc, ATW_SYNCTL),
2018 		                       ATW_SYNCTL_DATA_MASK);
2019 	return 0;
2020 }
2021 #endif /* ATW_SYNDEBUG */
2022 
2023 /* XXX is the endianness correct? test. */
2024 #define	atw_calchash(addr) \
2025 	(ether_crc32_le((addr), IEEE80211_ADDR_LEN) & BITS(5, 0))
2026 
2027 /*
2028  * atw_filter_setup:
2029  *
2030  *	Set the ADM8211's receive filter.
2031  */
2032 void
2033 atw_filter_setup(struct atw_softc *sc)
2034 {
2035 	struct ieee80211com *ic = &sc->sc_ic;
2036 	struct arpcom *ec = &ic->ic_ac;
2037 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2038 	int hash;
2039 	u_int32_t hashes[2];
2040 	struct ether_multi *enm;
2041 	struct ether_multistep step;
2042 
2043 	/* According to comments in tlp_al981_filter_setup
2044 	 * (dev/ic/tulip.c) the ADMtek AL981 does not like for its
2045 	 * multicast filter to be set while it is running.  Hopefully
2046 	 * the ADM8211 is not the same!
2047 	 */
2048 	if ((ifp->if_flags & IFF_RUNNING) != 0)
2049 		atw_idle(sc, ATW_NAR_SR);
2050 
2051 	sc->sc_opmode &= ~(ATW_NAR_PR|ATW_NAR_MM);
2052 
2053 	/* XXX in scan mode, do not filter packets.  Maybe this is
2054 	 * unnecessary.
2055 	 */
2056 	if (ic->ic_state == IEEE80211_S_SCAN ||
2057 	    (ifp->if_flags & IFF_PROMISC) != 0) {
2058 		sc->sc_opmode |= ATW_NAR_PR;
2059 		goto allmulti;
2060 	}
2061 
2062 	hashes[0] = hashes[1] = 0x0;
2063 
2064 	/*
2065 	 * Program the 64-bit multicast hash filter.
2066 	 */
2067 	ETHER_FIRST_MULTI(step, ec, enm);
2068 	while (enm != NULL) {
2069 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
2070 		    ETHER_ADDR_LEN) != 0)
2071 			goto allmulti;
2072 
2073 		hash = atw_calchash(enm->enm_addrlo);
2074 		hashes[hash >> 5] |= 1 << (hash & 0x1f);
2075 		ETHER_NEXT_MULTI(step, enm);
2076 		sc->sc_opmode |= ATW_NAR_MM;
2077 	}
2078 	ifp->if_flags &= ~IFF_ALLMULTI;
2079 	goto setit;
2080 
2081 allmulti:
2082 	sc->sc_opmode |= ATW_NAR_MM;
2083 	ifp->if_flags |= IFF_ALLMULTI;
2084 	hashes[0] = hashes[1] = 0xffffffff;
2085 
2086 setit:
2087 	ATW_WRITE(sc, ATW_MAR0, hashes[0]);
2088 	ATW_WRITE(sc, ATW_MAR1, hashes[1]);
2089 	ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
2090 	DELAY(20 * 1000);
2091 	ATW_WRITE(sc, ATW_RDR, 0x1);
2092 
2093 	DPRINTF(sc, ("%s: ATW_NAR %08x opmode %08x\n", sc->sc_dev.dv_xname,
2094 	    ATW_READ(sc, ATW_NAR), sc->sc_opmode));
2095 }
2096 
2097 /* Tell the ADM8211 our preferred BSSID. The ADM8211 must match
2098  * a beacon's BSSID and SSID against the preferred BSSID and SSID
2099  * before it will raise ATW_INTR_LINKON. When the ADM8211 receives
2100  * no beacon with the preferred BSSID and SSID in the number of
2101  * beacon intervals given in ATW_BPLI, then it raises ATW_INTR_LINKOFF.
2102  */
2103 void
2104 atw_write_bssid(struct atw_softc *sc)
2105 {
2106 	struct ieee80211com *ic = &sc->sc_ic;
2107 	u_int8_t *bssid;
2108 
2109 	bssid = ic->ic_bss->ni_bssid;
2110 
2111 	ATW_WRITE(sc, ATW_BSSID0,
2112 	    LSHIFT(bssid[0], ATW_BSSID0_BSSIDB0_MASK) |
2113 	    LSHIFT(bssid[1], ATW_BSSID0_BSSIDB1_MASK) |
2114 	    LSHIFT(bssid[2], ATW_BSSID0_BSSIDB2_MASK) |
2115 	    LSHIFT(bssid[3], ATW_BSSID0_BSSIDB3_MASK));
2116 
2117 	ATW_WRITE(sc, ATW_ABDA1,
2118 	    (ATW_READ(sc, ATW_ABDA1) &
2119 	    ~(ATW_ABDA1_BSSIDB4_MASK|ATW_ABDA1_BSSIDB5_MASK)) |
2120 	    LSHIFT(bssid[4], ATW_ABDA1_BSSIDB4_MASK) |
2121 	    LSHIFT(bssid[5], ATW_ABDA1_BSSIDB5_MASK));
2122 
2123 	DPRINTF(sc, ("%s: BSSID %s -> ", sc->sc_dev.dv_xname,
2124 	    ether_sprintf(sc->sc_bssid)));
2125 	DPRINTF(sc, ("%s\n", ether_sprintf(bssid)));
2126 
2127 	memcpy(sc->sc_bssid, bssid, sizeof(sc->sc_bssid));
2128 }
2129 
2130 /* Write buflen bytes from buf to SRAM starting at the SRAM's ofs'th
2131  * 16-bit word.
2132  */
2133 void
2134 atw_write_sram(struct atw_softc *sc, u_int ofs, u_int8_t *buf, u_int buflen)
2135 {
2136 	u_int i;
2137 	u_int8_t *ptr;
2138 
2139 	memcpy(&sc->sc_sram[ofs], buf, buflen);
2140 
2141 	KASSERT(ofs % 2 == 0 && buflen % 2 == 0);
2142 
2143 	KASSERT(buflen + ofs <= sc->sc_sramlen);
2144 
2145 	ptr = &sc->sc_sram[ofs];
2146 
2147 	for (i = 0; i < buflen; i += 2) {
2148 		ATW_WRITE(sc, ATW_WEPCTL, ATW_WEPCTL_WR |
2149 		    LSHIFT((ofs + i) / 2, ATW_WEPCTL_TBLADD_MASK));
2150 		DELAY(atw_writewep_delay);
2151 
2152 		ATW_WRITE(sc, ATW_WESK,
2153 		    LSHIFT((ptr[i + 1] << 8) | ptr[i], ATW_WESK_DATA_MASK));
2154 		DELAY(atw_writewep_delay);
2155 	}
2156 	ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl); /* restore WEP condition */
2157 
2158 	if (sc->sc_if.if_flags & IFF_DEBUG) {
2159 		int n_octets = 0;
2160 		printf("%s: wrote %d bytes at 0x%x wepctl 0x%08x\n",
2161 		    sc->sc_dev.dv_xname, buflen, ofs, sc->sc_wepctl);
2162 		for (i = 0; i < buflen; i++) {
2163 			printf(" %02x", ptr[i]);
2164 			if (++n_octets % 24 == 0)
2165 				printf("\n");
2166 		}
2167 		if (n_octets % 24 != 0)
2168 			printf("\n");
2169 	}
2170 }
2171 
2172 /* Write WEP keys from the ieee80211com to the ADM8211's SRAM. */
2173 void
2174 atw_write_wep(struct atw_softc *sc)
2175 {
2176 	struct ieee80211com *ic = &sc->sc_ic;
2177 #if 0
2178 	u_int32_t reg;
2179 	int i;
2180 #endif
2181 	/* SRAM shared-key record format: key0 flags key1 ... key12 */
2182 	u_int8_t buf[IEEE80211_WEP_NKID]
2183 	            [1 /* key[0] */ + 1 /* flags */ + 12 /* key[1 .. 12] */];
2184 
2185 	sc->sc_wepctl = 0;
2186 	ATW_WRITE(sc, ATW_WEPCTL, sc->sc_wepctl);
2187 
2188 	if ((ic->ic_flags & IEEE80211_F_WEPON) == 0)
2189 		return;
2190 
2191 	memset(&buf[0][0], 0, sizeof(buf));
2192 
2193 #if 0
2194 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2195 		if (ic->ic_nw_keys[i].k_len > 5) {
2196 			buf[i][1] = ATW_WEP_ENABLED | ATW_WEP_104BIT;
2197 		} else if (ic->ic_nw_keys[i].k_len != 0) {
2198 			buf[i][1] = ATW_WEP_ENABLED;
2199 		} else {
2200 			buf[i][1] = 0;
2201 			continue;
2202 		}
2203 		buf[i][0] = ic->ic_nw_keys[i].k_key[0];
2204 		memcpy(&buf[i][2], &ic->ic_nw_keys[i].k_key[1],
2205 		    ic->ic_nw_keys[i].k_len - 1);
2206 	}
2207 
2208 	reg = ATW_READ(sc, ATW_MACTEST);
2209 	reg |= ATW_MACTEST_MMI_USETXCLK | ATW_MACTEST_FORCE_KEYID;
2210 	reg &= ~ATW_MACTEST_KEYID_MASK;
2211 	reg |= LSHIFT(ic->ic_wep_txkey, ATW_MACTEST_KEYID_MASK);
2212 	ATW_WRITE(sc, ATW_MACTEST, reg);
2213 
2214 	sc->sc_wepctl = ATW_WEPCTL_WEPENABLE;
2215 
2216 	switch (sc->sc_rev) {
2217 	case ATW_REVISION_AB:
2218 	case ATW_REVISION_AF:
2219 		/* Bypass WEP on Rx. */
2220 		sc->sc_wepctl |= ATW_WEPCTL_WEPRXBYP;
2221 		break;
2222 	default:
2223 		break;
2224 	}
2225 #endif
2226 
2227 	atw_write_sram(sc, ATW_SRAM_ADDR_SHARED_KEY, (u_int8_t*)&buf[0][0],
2228 	    sizeof(buf));
2229 }
2230 
2231 void
2232 atw_change_ibss(struct atw_softc *sc)
2233 {
2234 	atw_predict_beacon(sc);
2235 	atw_write_bssid(sc);
2236 	atw_start_beacon(sc, 1);
2237 }
2238 
2239 #ifndef IEEE80211_STA_ONLY
2240 void
2241 atw_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
2242     struct ieee80211_node *ni, struct ieee80211_rxinfo *rxi, int subtype)
2243 {
2244 	struct atw_softc *sc = (struct atw_softc*)ic->ic_softc;
2245 
2246 	/* The ADM8211A answers probe requests. */
2247 	if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_REQ &&
2248 	    sc->sc_rev < ATW_REVISION_BA)
2249 		return;
2250 
2251 	(*sc->sc_recv_mgmt)(ic, m, ni, rxi, subtype);
2252 
2253 	switch (subtype) {
2254 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2255 	case IEEE80211_FC0_SUBTYPE_BEACON:
2256 		if (ic->ic_opmode != IEEE80211_M_IBSS ||
2257 		    ic->ic_state != IEEE80211_S_RUN)
2258 			break;
2259 		if (ieee80211_ibss_merge(ic, ni, atw_get_tsft(sc)) == ENETRESET)
2260 			atw_change_ibss(sc);
2261 		break;
2262 	default:
2263 		break;
2264 	}
2265 	return;
2266 }
2267 #endif
2268 
2269 /* Write the SSID in the ieee80211com to the SRAM on the ADM8211.
2270  * In ad hoc mode, the SSID is written to the beacons sent by the
2271  * ADM8211. In both ad hoc and infrastructure mode, beacons received
2272  * with matching SSID affect ATW_INTR_LINKON/ATW_INTR_LINKOFF
2273  * indications.
2274  */
2275 void
2276 atw_write_ssid(struct atw_softc *sc)
2277 {
2278 	struct ieee80211com *ic = &sc->sc_ic;
2279 	/* 34 bytes are reserved in ADM8211 SRAM for the SSID, but
2280 	 * it only expects the element length, not its ID.
2281 	 */
2282 	u_int8_t buf[roundup(1 /* length */ + IEEE80211_NWID_LEN, 2)];
2283 
2284 	memset(buf, 0, sizeof(buf));
2285 	buf[0] = ic->ic_bss->ni_esslen;
2286 	memcpy(&buf[1], ic->ic_bss->ni_essid, ic->ic_bss->ni_esslen);
2287 
2288 	atw_write_sram(sc, ATW_SRAM_ADDR_SSID, buf,
2289 	    roundup(1 + ic->ic_bss->ni_esslen, 2));
2290 }
2291 
2292 /* Write the supported rates in the ieee80211com to the SRAM of the ADM8211.
2293  * In ad hoc mode, the supported rates are written to beacons sent by the
2294  * ADM8211.
2295  */
2296 void
2297 atw_write_sup_rates(struct atw_softc *sc)
2298 {
2299 	struct ieee80211com *ic = &sc->sc_ic;
2300 	/* 14 bytes are probably (XXX) reserved in the ADM8211 SRAM for
2301 	 * supported rates
2302 	 */
2303 	u_int8_t buf[roundup(1 /* length */ + IEEE80211_RATE_SIZE, 2)];
2304 
2305 	memset(buf, 0, sizeof(buf));
2306 	buf[0] = ic->ic_bss->ni_rates.rs_nrates;
2307 	memcpy(&buf[1], ic->ic_bss->ni_rates.rs_rates,
2308 	    ic->ic_bss->ni_rates.rs_nrates);
2309 
2310 	/* XXX deal with rev BA bug linux driver talks of? */
2311 
2312 	atw_write_sram(sc, ATW_SRAM_ADDR_SUPRATES, buf, sizeof(buf));
2313 }
2314 
2315 /* Start/stop sending beacons. */
2316 void
2317 atw_start_beacon(struct atw_softc *sc, int start)
2318 {
2319 	struct ieee80211com *ic = &sc->sc_ic;
2320 #ifndef IEEE80211_STA_ONLY
2321 	uint16_t chan;
2322 	uint32_t bpli;
2323 #endif
2324 	uint32_t bcnt, cap0, cap1, capinfo;
2325 	size_t len;
2326 
2327 	if (ATW_IS_ENABLED(sc) == 0)
2328 		return;
2329 
2330 	/* start beacons */
2331 	len = sizeof(struct ieee80211_frame) +
2332 	    8 /* timestamp */ + 2 /* beacon interval */ +
2333 	    2 /* capability info */ +
2334 	    2 + ic->ic_bss->ni_esslen /* SSID element */ +
2335 	    2 + ic->ic_bss->ni_rates.rs_nrates /* rates element */ +
2336 	    3 /* DS parameters */ +
2337 	    IEEE80211_CRC_LEN;
2338 
2339 	bcnt = ATW_READ(sc, ATW_BCNT) & ~ATW_BCNT_BCNT_MASK;
2340 	cap0 = ATW_READ(sc, ATW_CAP0) & ~ATW_CAP0_CHN_MASK;
2341 	cap1 = ATW_READ(sc, ATW_CAP1) & ~ATW_CAP1_CAPI_MASK;
2342 
2343 	ATW_WRITE(sc, ATW_BCNT, bcnt);
2344 	ATW_WRITE(sc, ATW_CAP1, cap1);
2345 
2346 	if (!start)
2347 		return;
2348 
2349 	/* TBD use ni_capinfo */
2350 
2351 	capinfo = 0;
2352 	if (sc->sc_flags & ATWF_SHORT_PREAMBLE)
2353 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
2354 	if (ic->ic_flags & IEEE80211_F_WEPON)
2355 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
2356 
2357 #ifndef IEEE80211_STA_ONLY
2358 	switch (ic->ic_opmode) {
2359 	case IEEE80211_M_IBSS:
2360 		len += 4; /* IBSS parameters */
2361 		capinfo |= IEEE80211_CAPINFO_IBSS;
2362 		break;
2363 	default:
2364 		return;
2365 	}
2366 
2367 	/* set listen interval
2368 	 * XXX do software units agree w/ hardware?
2369 	 */
2370 	bpli = LSHIFT(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
2371 	    LSHIFT(ic->ic_lintval / ic->ic_bss->ni_intval, ATW_BPLI_LI_MASK);
2372 
2373 	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
2374 
2375 	bcnt |= LSHIFT(len, ATW_BCNT_BCNT_MASK);
2376 	cap0 |= LSHIFT(chan, ATW_CAP0_CHN_MASK);
2377 	cap1 |= LSHIFT(capinfo, ATW_CAP1_CAPI_MASK);
2378 
2379 	ATW_WRITE(sc, ATW_BCNT, bcnt);
2380 	ATW_WRITE(sc, ATW_BPLI, bpli);
2381 	ATW_WRITE(sc, ATW_CAP0, cap0);
2382 	ATW_WRITE(sc, ATW_CAP1, cap1);
2383 
2384 	DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_BCNT] = %08x\n",
2385 	    sc->sc_dev.dv_xname, bcnt));
2386 	DPRINTF(sc, ("%s: atw_start_beacon reg[ATW_CAP1] = %08x\n",
2387 	    sc->sc_dev.dv_xname, cap1));
2388 #endif
2389 }
2390 
2391 /* Return the 32 lsb of the last TSFT divisible by ival. */
2392 static __inline uint32_t
2393 atw_last_even_tsft(uint32_t tsfth, uint32_t tsftl, uint32_t ival)
2394 {
2395 	/* Following the reference driver's lead, I compute
2396 	 *
2397 	 *   (uint32_t)((((uint64_t)tsfth << 32) | tsftl) % ival)
2398 	 *
2399 	 * without using 64-bit arithmetic, using the following
2400 	 * relationship:
2401 	 *
2402 	 *     (0x100000000 * H + L) % m
2403 	 *   = ((0x100000000 % m) * H + L) % m
2404 	 *   = (((0xffffffff + 1) % m) * H + L) % m
2405 	 *   = ((0xffffffff % m + 1 % m) * H + L) % m
2406 	 *   = ((0xffffffff % m + 1) * H + L) % m
2407 	 */
2408 	return ((0xFFFFFFFF % ival + 1) * tsfth + tsftl) % ival;
2409 }
2410 
2411 uint64_t
2412 atw_get_tsft(struct atw_softc *sc)
2413 {
2414 	int i;
2415 	uint32_t tsfth, tsftl;
2416 	for (i = 0; i < 2; i++) {
2417 		tsfth = ATW_READ(sc, ATW_TSFTH);
2418 		tsftl = ATW_READ(sc, ATW_TSFTL);
2419 		if (ATW_READ(sc, ATW_TSFTH) == tsfth)
2420 			break;
2421 	}
2422 	return ((uint64_t)tsfth << 32) | tsftl;
2423 }
2424 
2425 /* If we've created an IBSS, write the TSF time in the ADM8211 to
2426  * the ieee80211com.
2427  *
2428  * Predict the next target beacon transmission time (TBTT) and
2429  * write it to the ADM8211.
2430  */
2431 void
2432 atw_predict_beacon(struct atw_softc *sc)
2433 {
2434 #define TBTTOFS 20 /* TU */
2435 
2436 	struct ieee80211com *ic = &sc->sc_ic;
2437 	uint64_t tsft;
2438 	uint32_t ival, past_even, tbtt, tsfth, tsftl;
2439 	union {
2440 		uint64_t	word;
2441 		uint8_t		tstamp[8];
2442 	} u;
2443 
2444 #ifndef IEEE80211_STA_ONLY
2445 	if ((ic->ic_opmode == IEEE80211_M_IBSS) &&
2446 	    (ic->ic_flags & IEEE80211_F_SIBSS)) {
2447 		tsft = atw_get_tsft(sc);
2448 		u.word = htole64(tsft);
2449 		(void)memcpy(&ic->ic_bss->ni_tstamp[0], &u.tstamp[0],
2450 		    sizeof(ic->ic_bss->ni_tstamp));
2451 	} else
2452 #endif
2453 	{
2454 		(void)memcpy(&u, &ic->ic_bss->ni_tstamp[0], sizeof(u));
2455 		tsft = letoh64(u.word);
2456 	}
2457 
2458 	ival = ic->ic_bss->ni_intval * IEEE80211_DUR_TU;
2459 
2460 	tsftl = tsft & 0xFFFFFFFF;
2461 	tsfth = tsft >> 32;
2462 
2463 	/* We sent/received the last beacon `past' microseconds
2464 	 * after the interval divided the TSF timer.
2465 	 */
2466 	past_even = tsftl - atw_last_even_tsft(tsfth, tsftl, ival);
2467 
2468 	/* Skip ten beacons so that the TBTT cannot pass before
2469 	 * we've programmed it.  Ten is an arbitrary number.
2470 	 */
2471 	tbtt = past_even + ival * 10;
2472 
2473 	ATW_WRITE(sc, ATW_TOFS1,
2474 	    LSHIFT(1, ATW_TOFS1_TSFTOFSR_MASK) |
2475 	    LSHIFT(TBTTOFS, ATW_TOFS1_TBTTOFS_MASK) |
2476 	    LSHIFT(MASK_AND_RSHIFT(tbtt - TBTTOFS * IEEE80211_DUR_TU,
2477 	        ATW_TBTTPRE_MASK), ATW_TOFS1_TBTTPRE_MASK));
2478 #undef TBTTOFS
2479 }
2480 
2481 void
2482 atw_next_scan(void *arg)
2483 {
2484 	struct atw_softc *sc = arg;
2485 	struct ieee80211com *ic = &sc->sc_ic;
2486 	struct ifnet *ifp = &ic->ic_if;
2487 	int s;
2488 
2489 	/* don't call atw_start w/o network interrupts blocked */
2490 	s = splnet();
2491 	if (ic->ic_state == IEEE80211_S_SCAN)
2492 		ieee80211_next_scan(ifp);
2493 	splx(s);
2494 }
2495 
2496 /* Synchronize the hardware state with the software state. */
2497 int
2498 atw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2499 {
2500 	struct ifnet *ifp = &ic->ic_if;
2501 	struct atw_softc *sc = ifp->if_softc;
2502 	enum ieee80211_state ostate = ic->ic_state;
2503 	int error;
2504 
2505 	if (nstate == IEEE80211_S_INIT) {
2506 		timeout_del(&sc->sc_scan_to);
2507 		sc->sc_cur_chan = IEEE80211_CHAN_ANY;
2508 		atw_start_beacon(sc, 0);
2509 		return (*sc->sc_newstate)(ic, nstate, arg);
2510 	}
2511 
2512 	if ((error = atw_tune(sc)) != 0)
2513 		return error;
2514 
2515 	switch (nstate) {
2516 	case IEEE80211_S_ASSOC:
2517 		break;
2518 	case IEEE80211_S_INIT:
2519 		panic("%s: unexpected state IEEE80211_S_INIT", __func__);
2520 		break;
2521 	case IEEE80211_S_SCAN:
2522 		timeout_add_msec(&sc->sc_scan_to, atw_dwelltime);
2523 		break;
2524 	case IEEE80211_S_RUN:
2525 		if (ic->ic_opmode == IEEE80211_M_STA)
2526 			break;
2527 		/*FALLTHROUGH*/
2528 	case IEEE80211_S_AUTH:
2529 		atw_write_bssid(sc);
2530 		atw_write_ssid(sc);
2531 		atw_write_sup_rates(sc);
2532 
2533 		if (
2534 #ifndef IEEE80211_STA_ONLY
2535 		    ic->ic_opmode == IEEE80211_M_AHDEMO ||
2536 #endif
2537 		    ic->ic_opmode == IEEE80211_M_MONITOR)
2538 			break;
2539 
2540 		/* set listen interval
2541 		 * XXX do software units agree w/ hardware?
2542 		 */
2543 		ATW_WRITE(sc, ATW_BPLI,
2544 		    LSHIFT(ic->ic_bss->ni_intval, ATW_BPLI_BP_MASK) |
2545 		    LSHIFT(ic->ic_lintval / ic->ic_bss->ni_intval,
2546 			   ATW_BPLI_LI_MASK));
2547 
2548 		DPRINTF(sc, ("%s: reg[ATW_BPLI] = %08x\n",
2549 		    sc->sc_dev.dv_xname, ATW_READ(sc, ATW_BPLI)));
2550 
2551 		atw_predict_beacon(sc);
2552 		break;
2553 	}
2554 
2555 	if (nstate != IEEE80211_S_SCAN)
2556 		timeout_del(&sc->sc_scan_to);
2557 
2558 #ifndef IEEE80211_STA_ONLY
2559 	if (nstate == IEEE80211_S_RUN &&
2560 	    ic->ic_opmode == IEEE80211_M_IBSS)
2561 		atw_start_beacon(sc, 1);
2562 	else
2563 #endif
2564 		atw_start_beacon(sc, 0);
2565 
2566 	error = (*sc->sc_newstate)(ic, nstate, arg);
2567 
2568 	if (ostate == IEEE80211_S_INIT && nstate == IEEE80211_S_SCAN)
2569 		atw_write_bssid(sc);
2570 
2571 	return error;
2572 }
2573 
2574 /*
2575  * atw_add_rxbuf:
2576  *
2577  *	Add a receive buffer to the indicated descriptor.
2578  */
2579 int
2580 atw_add_rxbuf(struct atw_softc *sc, int idx)
2581 {
2582 	struct atw_rxsoft *rxs = &sc->sc_rxsoft[idx];
2583 	struct mbuf *m;
2584 	int error;
2585 
2586 	MGETHDR(m, M_DONTWAIT, MT_DATA);
2587 	if (m == NULL)
2588 		return (ENOBUFS);
2589 
2590 	MCLGET(m, M_DONTWAIT);
2591 	if ((m->m_flags & M_EXT) == 0) {
2592 		m_freem(m);
2593 		return (ENOBUFS);
2594 	}
2595 
2596 	if (rxs->rxs_mbuf != NULL)
2597 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2598 
2599 	rxs->rxs_mbuf = m;
2600 
2601 	error = bus_dmamap_load(sc->sc_dmat, rxs->rxs_dmamap,
2602 	    m->m_ext.ext_buf, m->m_ext.ext_size, NULL,
2603 	    BUS_DMA_READ|BUS_DMA_NOWAIT);
2604 	if (error) {
2605 		printf("%s: can't load rx DMA map %d, error = %d\n",
2606 		    sc->sc_dev.dv_xname, idx, error);
2607 		panic("atw_add_rxbuf");	/* XXX */
2608 	}
2609 
2610 	bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
2611 	    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
2612 
2613 	ATW_INIT_RXDESC(sc, idx);
2614 
2615 	return (0);
2616 }
2617 
2618 /*
2619  * Release any queued transmit buffers.
2620  */
2621 void
2622 atw_txdrain(struct atw_softc *sc)
2623 {
2624 	struct atw_txsoft *txs;
2625 
2626 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
2627 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
2628 		if (txs->txs_mbuf != NULL) {
2629 			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
2630 			m_freem(txs->txs_mbuf);
2631 			txs->txs_mbuf = NULL;
2632 		}
2633 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
2634 	}
2635 	sc->sc_tx_timer = 0;
2636 }
2637 
2638 /*
2639  * atw_stop:		[ ifnet interface function ]
2640  *
2641  *	Stop transmission on the interface.
2642  */
2643 void
2644 atw_stop(struct ifnet *ifp, int disable)
2645 {
2646 	struct atw_softc *sc = ifp->if_softc;
2647 	struct ieee80211com *ic = &sc->sc_ic;
2648 
2649 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2650 
2651 	/*
2652 	 * Mark the interface down and cancel the watchdog timer.
2653 	*/
2654 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2655 	ifp->if_timer = 0;
2656 
2657 	/* Disable interrupts. */
2658 	ATW_WRITE(sc, ATW_IER, 0);
2659 
2660 	/* Stop the transmit and receive processes. */
2661 	sc->sc_opmode = 0;
2662 	ATW_WRITE(sc, ATW_NAR, 0);
2663 	DELAY(20 * 1000);
2664 	ATW_WRITE(sc, ATW_TDBD, 0);
2665 	ATW_WRITE(sc, ATW_TDBP, 0);
2666 	ATW_WRITE(sc, ATW_RDB, 0);
2667 
2668 	atw_txdrain(sc);
2669 
2670 	if (disable) {
2671 		atw_rxdrain(sc);
2672 		atw_disable(sc);
2673 	}
2674 
2675 	if (!disable)
2676 		atw_reset(sc);
2677 }
2678 
2679 /*
2680  * atw_rxdrain:
2681  *
2682  *	Drain the receive queue.
2683  */
2684 void
2685 atw_rxdrain(struct atw_softc *sc)
2686 {
2687 	struct atw_rxsoft *rxs;
2688 	int i;
2689 
2690 	for (i = 0; i < ATW_NRXDESC; i++) {
2691 		rxs = &sc->sc_rxsoft[i];
2692 		if (rxs->rxs_mbuf == NULL)
2693 			continue;
2694 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2695 		m_freem(rxs->rxs_mbuf);
2696 		rxs->rxs_mbuf = NULL;
2697 	}
2698 }
2699 
2700 /*
2701  * atw_detach:
2702  *
2703  *	Detach an ADM8211 interface.
2704  */
2705 int
2706 atw_detach(struct atw_softc *sc)
2707 {
2708 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2709 	struct atw_rxsoft *rxs;
2710 	struct atw_txsoft *txs;
2711 	int i;
2712 
2713 	/*
2714 	 * Succeed now if there isn't any work to do.
2715 	 */
2716 	if ((sc->sc_flags & ATWF_ATTACHED) == 0)
2717 		return (0);
2718 
2719 	timeout_del(&sc->sc_scan_to);
2720 
2721 	ieee80211_ifdetach(ifp);
2722 	if_detach(ifp);
2723 
2724 	for (i = 0; i < ATW_NRXDESC; i++) {
2725 		rxs = &sc->sc_rxsoft[i];
2726 		if (rxs->rxs_mbuf != NULL) {
2727 			bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
2728 			m_freem(rxs->rxs_mbuf);
2729 			rxs->rxs_mbuf = NULL;
2730 		}
2731 		bus_dmamap_destroy(sc->sc_dmat, rxs->rxs_dmamap);
2732 	}
2733 	for (i = 0; i < ATW_TXQUEUELEN; i++) {
2734 		txs = &sc->sc_txsoft[i];
2735 		if (txs->txs_mbuf != NULL) {
2736 			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
2737 			m_freem(txs->txs_mbuf);
2738 			txs->txs_mbuf = NULL;
2739 		}
2740 		bus_dmamap_destroy(sc->sc_dmat, txs->txs_dmamap);
2741 	}
2742 	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
2743 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
2744 	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_control_data,
2745 	    sizeof(struct atw_control_data));
2746 	bus_dmamem_free(sc->sc_dmat, &sc->sc_cdseg, sc->sc_cdnseg);
2747 
2748 	if (sc->sc_sdhook != NULL)
2749 		shutdownhook_disestablish(sc->sc_sdhook);
2750 	if (sc->sc_powerhook != NULL)
2751 		powerhook_disestablish(sc->sc_powerhook);
2752 
2753 	if (sc->sc_srom)
2754 		free(sc->sc_srom, M_DEVBUF);
2755 
2756 	return (0);
2757 }
2758 
2759 /* atw_shutdown: make sure the interface is stopped at reboot time. */
2760 void
2761 atw_shutdown(void *arg)
2762 {
2763 	struct atw_softc *sc = arg;
2764 
2765 	atw_stop(&sc->sc_ic.ic_if, 1);
2766 }
2767 
2768 int
2769 atw_intr(void *arg)
2770 {
2771 	struct atw_softc *sc = arg;
2772 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2773 	u_int32_t status, rxstatus, txstatus, linkstatus;
2774 	int handled = 0, txthresh;
2775 
2776 #ifdef DEBUG
2777 	if (ATW_IS_ENABLED(sc) == 0)
2778 		panic("%s: atw_intr: not enabled", sc->sc_dev.dv_xname);
2779 #endif
2780 
2781 	/*
2782 	 * If the interface isn't running, the interrupt couldn't
2783 	 * possibly have come from us.
2784 	 */
2785 	if ((ifp->if_flags & IFF_RUNNING) == 0 ||
2786 	    (sc->sc_dev.dv_flags & DVF_ACTIVE) == 0)
2787 		return (0);
2788 
2789 	for (;;) {
2790 		status = ATW_READ(sc, ATW_STSR);
2791 
2792 		if (status)
2793 			ATW_WRITE(sc, ATW_STSR, status);
2794 
2795 #ifdef ATW_DEBUG
2796 #define PRINTINTR(flag) do { \
2797 	if ((status & flag) != 0) { \
2798 		printf("%s" #flag, delim); \
2799 		delim = ","; \
2800 	} \
2801 } while (0)
2802 
2803 		if (atw_debug > 1 && status) {
2804 			const char *delim = "<";
2805 
2806 			printf("%s: reg[STSR] = %x",
2807 			    sc->sc_dev.dv_xname, status);
2808 
2809 			PRINTINTR(ATW_INTR_FBE);
2810 			PRINTINTR(ATW_INTR_LINKOFF);
2811 			PRINTINTR(ATW_INTR_LINKON);
2812 			PRINTINTR(ATW_INTR_RCI);
2813 			PRINTINTR(ATW_INTR_RDU);
2814 			PRINTINTR(ATW_INTR_REIS);
2815 			PRINTINTR(ATW_INTR_RPS);
2816 			PRINTINTR(ATW_INTR_TCI);
2817 			PRINTINTR(ATW_INTR_TDU);
2818 			PRINTINTR(ATW_INTR_TLT);
2819 			PRINTINTR(ATW_INTR_TPS);
2820 			PRINTINTR(ATW_INTR_TRT);
2821 			PRINTINTR(ATW_INTR_TUF);
2822 			PRINTINTR(ATW_INTR_BCNTC);
2823 			PRINTINTR(ATW_INTR_ATIME);
2824 			PRINTINTR(ATW_INTR_TBTT);
2825 			PRINTINTR(ATW_INTR_TSCZ);
2826 			PRINTINTR(ATW_INTR_TSFTF);
2827 			printf(">\n");
2828 		}
2829 #undef PRINTINTR
2830 #endif /* ATW_DEBUG */
2831 
2832 		if ((status & sc->sc_inten) == 0)
2833 			break;
2834 
2835 		handled = 1;
2836 
2837 		rxstatus = status & sc->sc_rxint_mask;
2838 		txstatus = status & sc->sc_txint_mask;
2839 		linkstatus = status & sc->sc_linkint_mask;
2840 
2841 		if (linkstatus) {
2842 			atw_linkintr(sc, linkstatus);
2843 		}
2844 
2845 		if (rxstatus) {
2846 			/* Grab any new packets. */
2847 			atw_rxintr(sc);
2848 
2849 			if (rxstatus & ATW_INTR_RDU) {
2850 				printf("%s: receive ring overrun\n",
2851 				    sc->sc_dev.dv_xname);
2852 				/* Get the receive process going again. */
2853 				ATW_WRITE(sc, ATW_RDR, 0x1);
2854 				break;
2855 			}
2856 		}
2857 
2858 		if (txstatus) {
2859 			/* Sweep up transmit descriptors. */
2860 			atw_txintr(sc);
2861 
2862 			if (txstatus & ATW_INTR_TLT)
2863 				DPRINTF(sc, ("%s: tx lifetime exceeded\n",
2864 				    sc->sc_dev.dv_xname));
2865 
2866 			if (txstatus & ATW_INTR_TRT)
2867 				DPRINTF(sc, ("%s: tx retry limit exceeded\n",
2868 				    sc->sc_dev.dv_xname));
2869 
2870 			/* If Tx under-run, increase our transmit threshold
2871 			 * if another is available.
2872 			 */
2873 			txthresh = sc->sc_txthresh + 1;
2874 			if ((txstatus & ATW_INTR_TUF) &&
2875 			    sc->sc_txth[txthresh].txth_name != NULL) {
2876 				/* Idle the transmit process. */
2877 				atw_idle(sc, ATW_NAR_ST);
2878 
2879 				sc->sc_txthresh = txthresh;
2880 				sc->sc_opmode &= ~(ATW_NAR_TR_MASK|ATW_NAR_SF);
2881 				sc->sc_opmode |=
2882 				    sc->sc_txth[txthresh].txth_opmode;
2883 				printf("%s: transmit underrun; new "
2884 				    "threshold: %s\n", sc->sc_dev.dv_xname,
2885 				    sc->sc_txth[txthresh].txth_name);
2886 
2887 				/* Set the new threshold and restart
2888 				 * the transmit process.
2889 				 */
2890 				ATW_WRITE(sc, ATW_NAR, sc->sc_opmode);
2891 				DELAY(20 * 1000);
2892 				ATW_WRITE(sc, ATW_RDR, 0x1);
2893 				/* XXX Log every Nth underrun from
2894 				 * XXX now on?
2895 				 */
2896 			}
2897 		}
2898 
2899 		if (status & (ATW_INTR_TPS|ATW_INTR_RPS)) {
2900 			if (status & ATW_INTR_TPS)
2901 				printf("%s: transmit process stopped\n",
2902 				    sc->sc_dev.dv_xname);
2903 			if (status & ATW_INTR_RPS)
2904 				printf("%s: receive process stopped\n",
2905 				    sc->sc_dev.dv_xname);
2906 			(void)atw_init(ifp);
2907 			break;
2908 		}
2909 
2910 		if (status & ATW_INTR_FBE) {
2911 			printf("%s: fatal bus error\n", sc->sc_dev.dv_xname);
2912 			(void)atw_init(ifp);
2913 			break;
2914 		}
2915 
2916 		/*
2917 		 * Not handled:
2918 		 *
2919 		 *	Transmit buffer unavailable -- normal
2920 		 *	condition, nothing to do, really.
2921 		 *
2922 		 *	Early receive interrupt -- not available on
2923 		 *	all chips, we just use RI.  We also only
2924 		 *	use single-segment receive DMA, so this
2925 		 *	is mostly useless.
2926 		 *
2927 		 *      TBD others
2928 		 */
2929 	}
2930 
2931 	/* Try to get more packets going. */
2932 	atw_start(ifp);
2933 
2934 	return (handled);
2935 }
2936 
2937 /*
2938  * atw_idle:
2939  *
2940  *	Cause the transmit and/or receive processes to go idle.
2941  *
2942  *      XXX It seems that the ADM8211 will not signal the end of the Rx/Tx
2943  *	process in STSR if I clear SR or ST after the process has already
2944  *	ceased. Fair enough. But the Rx process status bits in ATW_TEST0
2945  *      do not seem to be too reliable. Perhaps I have the sense of the
2946  *	Rx bits switched with the Tx bits?
2947  */
2948 void
2949 atw_idle(struct atw_softc *sc, u_int32_t bits)
2950 {
2951 	u_int32_t ackmask = 0, opmode, stsr, test0;
2952 	int i, s;
2953 
2954 	s = splnet();
2955 
2956 	opmode = sc->sc_opmode & ~bits;
2957 
2958 	if (bits & ATW_NAR_SR)
2959 		ackmask |= ATW_INTR_RPS;
2960 
2961 	if (bits & ATW_NAR_ST) {
2962 		ackmask |= ATW_INTR_TPS;
2963 		/* set ATW_NAR_HF to flush TX FIFO. */
2964 		opmode |= ATW_NAR_HF;
2965 	}
2966 
2967 	ATW_WRITE(sc, ATW_NAR, opmode);
2968 	DELAY(20 * 1000);
2969 
2970 	for (i = 0; i < 10; i++) {
2971 		stsr = ATW_READ(sc, ATW_STSR);
2972 		if ((stsr & ackmask) == ackmask)
2973 			break;
2974 		DELAY(1000);
2975 	}
2976 
2977 	ATW_WRITE(sc, ATW_STSR, stsr & ackmask);
2978 
2979 	if ((stsr & ackmask) == ackmask)
2980 		goto out;
2981 
2982 	test0 = ATW_READ(sc, ATW_TEST0);
2983 
2984 	if ((bits & ATW_NAR_ST) != 0 && (stsr & ATW_INTR_TPS) == 0 &&
2985 	    (test0 & ATW_TEST0_TS_MASK) != ATW_TEST0_TS_STOPPED) {
2986 		DPRINTF2(sc, ("%s: transmit process not idle [%s]\n",
2987 		    sc->sc_dev.dv_xname,
2988 		    atw_tx_state[MASK_AND_RSHIFT(test0, ATW_TEST0_TS_MASK)]));
2989 		DPRINTF2(sc, ("%s: bits %08x test0 %08x stsr %08x\n",
2990 		    sc->sc_dev.dv_xname, bits, test0, stsr));
2991 	}
2992 
2993 	if ((bits & ATW_NAR_SR) != 0 && (stsr & ATW_INTR_RPS) == 0 &&
2994 	    (test0 & ATW_TEST0_RS_MASK) != ATW_TEST0_RS_STOPPED) {
2995 		DPRINTF2(sc, ("%s: receive process not idle [%s]\n",
2996 		    sc->sc_dev.dv_xname,
2997 		    atw_rx_state[MASK_AND_RSHIFT(test0, ATW_TEST0_RS_MASK)]));
2998 		DPRINTF2(sc, ("%s: bits %08x test0 %08x stsr %08x\n",
2999 		    sc->sc_dev.dv_xname, bits, test0, stsr));
3000 	}
3001 out:
3002 	if ((bits & ATW_NAR_ST) != 0)
3003 		atw_txdrain(sc);
3004 	splx(s);
3005 	return;
3006 }
3007 
3008 /*
3009  * atw_linkintr:
3010  *
3011  *	Helper; handle link-status interrupts.
3012  */
3013 void
3014 atw_linkintr(struct atw_softc *sc, u_int32_t linkstatus)
3015 {
3016 	struct ieee80211com *ic = &sc->sc_ic;
3017 
3018 	if (ic->ic_state != IEEE80211_S_RUN)
3019 		return;
3020 
3021 	if (linkstatus & ATW_INTR_LINKON) {
3022 		DPRINTF(sc, ("%s: link on\n", sc->sc_dev.dv_xname));
3023 		sc->sc_rescan_timer = 0;
3024 	} else if (linkstatus & ATW_INTR_LINKOFF) {
3025 		DPRINTF(sc, ("%s: link off\n", sc->sc_dev.dv_xname));
3026 		if (ic->ic_opmode != IEEE80211_M_STA)
3027 			return;
3028 		sc->sc_rescan_timer = 3;
3029 		ic->ic_if.if_timer = 1;
3030 	}
3031 }
3032 
3033 static __inline int
3034 atw_hw_decrypted(struct atw_softc *sc, struct ieee80211_frame *wh)
3035 {
3036 	if ((sc->sc_ic.ic_flags & IEEE80211_F_WEPON) == 0)
3037 		return 0;
3038 	if ((wh->i_fc[1] & IEEE80211_FC1_WEP) == 0)
3039 		return 0;
3040 	return (sc->sc_wepctl & ATW_WEPCTL_WEPRXBYP) == 0;
3041 }
3042 
3043 /*
3044  * atw_rxintr:
3045  *
3046  *	Helper; handle receive interrupts.
3047  */
3048 void
3049 atw_rxintr(struct atw_softc *sc)
3050 {
3051 	static int rate_tbl[] = {2, 4, 11, 22, 44};
3052 	struct ieee80211com *ic = &sc->sc_ic;
3053 	struct ieee80211_rxinfo rxi;
3054 	struct ieee80211_node *ni;
3055 	struct ieee80211_frame *wh;
3056 	struct ifnet *ifp = &ic->ic_if;
3057 	struct atw_rxsoft *rxs;
3058 	struct mbuf *m;
3059 	u_int32_t rxstat;
3060 	int i, len, rate, rate0;
3061 	u_int32_t rssi, rssi0;
3062 
3063 	for (i = sc->sc_rxptr;; i = ATW_NEXTRX(i)) {
3064 		rxs = &sc->sc_rxsoft[i];
3065 
3066 		ATW_CDRXSYNC(sc, i, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3067 
3068 		rxstat = letoh32(sc->sc_rxdescs[i].ar_stat);
3069 		rssi0 = letoh32(sc->sc_rxdescs[i].ar_rssi);
3070 		rate0 = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_RXDR_MASK);
3071 
3072 		if (rxstat & ATW_RXSTAT_OWN)
3073 			break; /* We have processed all receive buffers. */
3074 
3075 		DPRINTF3(sc,
3076 		    ("%s: rx stat %08x rssi0 %08x buf1 %08x buf2 %08x\n",
3077 		    sc->sc_dev.dv_xname,
3078 		    rxstat, rssi0,
3079 		    letoh32(sc->sc_rxdescs[i].ar_buf1),
3080 		    letoh32(sc->sc_rxdescs[i].ar_buf2)));
3081 
3082 		/*
3083 		 * Make sure the packet fits in one buffer.  This should
3084 		 * always be the case.
3085 		 */
3086 		if ((rxstat & (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) !=
3087 		    (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) {
3088 			printf("%s: incoming packet spilled, resetting\n",
3089 			    sc->sc_dev.dv_xname);
3090 			(void)atw_init(ifp);
3091 			return;
3092 		}
3093 
3094 		/*
3095 		 * If an error occurred, update stats, clear the status
3096 		 * word, and leave the packet buffer in place.  It will
3097 		 * simply be reused the next time the ring comes around.
3098 	 	 * If 802.1Q VLAN MTU is enabled, ignore the Frame Too Long
3099 		 * error.
3100 		 */
3101 
3102 		if ((rxstat & ATW_RXSTAT_ES) != 0 &&
3103 		    ((sc->sc_ic.ic_if.if_capabilities & IFCAP_VLAN_MTU) == 0 ||
3104 		     (rxstat & (ATW_RXSTAT_DE | ATW_RXSTAT_SFDE |
3105 		                ATW_RXSTAT_SIGE | ATW_RXSTAT_CRC16E |
3106 				ATW_RXSTAT_RXTOE | ATW_RXSTAT_CRC32E |
3107 				ATW_RXSTAT_ICVE)) != 0)) {
3108 #define	PRINTERR(bit, str)						\
3109 			if (rxstat & (bit))				\
3110 				printf("%s: receive error: %s\n",	\
3111 				    sc->sc_dev.dv_xname, str)
3112 			ifp->if_ierrors++;
3113 			PRINTERR(ATW_RXSTAT_DE, "descriptor error");
3114 			PRINTERR(ATW_RXSTAT_SFDE, "PLCP SFD error");
3115 			PRINTERR(ATW_RXSTAT_SIGE, "PLCP signal error");
3116 			PRINTERR(ATW_RXSTAT_CRC16E, "PLCP CRC16 error");
3117 			PRINTERR(ATW_RXSTAT_RXTOE, "time-out");
3118 			PRINTERR(ATW_RXSTAT_CRC32E, "FCS error");
3119 			PRINTERR(ATW_RXSTAT_ICVE, "WEP ICV error");
3120 #undef PRINTERR
3121 			ATW_INIT_RXDESC(sc, i);
3122 			continue;
3123 		}
3124 
3125 		bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
3126 		    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
3127 
3128 		/*
3129 		 * No errors; receive the packet.  Note the ADM8211
3130 		 * includes the CRC in promiscuous mode.
3131 		 */
3132 		len = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_FL_MASK);
3133 
3134 		/*
3135 		 * Allocate a new mbuf cluster.  If that fails, we are
3136 		 * out of memory, and must drop the packet and recycle
3137 		 * the buffer that's already attached to this descriptor.
3138 		 */
3139 		m = rxs->rxs_mbuf;
3140 		if (atw_add_rxbuf(sc, i) != 0) {
3141 			ifp->if_ierrors++;
3142 			ATW_INIT_RXDESC(sc, i);
3143 			bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
3144 			    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
3145 			continue;
3146 		}
3147 
3148 		if (sc->sc_opmode & ATW_NAR_PR)
3149 			len -= IEEE80211_CRC_LEN;
3150 		m->m_pkthdr.rcvif = ifp;
3151 		m->m_pkthdr.len = m->m_len = MIN(m->m_ext.ext_size, len);
3152 
3153 		if (rate0 >= sizeof(rate_tbl) / sizeof(rate_tbl[0]))
3154 			rate = 0;
3155 		else
3156 			rate = rate_tbl[rate0];
3157 
3158 		/* The RSSI comes straight from a register in the
3159 		 * baseband processor.  I know that for the RF3000,
3160 		 * the RSSI register also contains the antenna-selection
3161 		 * bits.  Mask those off.
3162 		 *
3163 		 * TBD Treat other basebands.
3164 		 */
3165 		if (sc->sc_bbptype == ATW_BBPTYPE_RFMD)
3166 			rssi = rssi0 & RF3000_RSSI_MASK;
3167 		else
3168 			rssi = rssi0;
3169 
3170 #if NBPFILTER > 0
3171 		/* Pass this up to any BPF listeners. */
3172 		if (sc->sc_radiobpf != NULL) {
3173 			struct mbuf mb;
3174 
3175 			struct atw_rx_radiotap_header *tap = &sc->sc_rxtap;
3176 
3177 			tap->ar_rate = rate;
3178 			tap->ar_chan_freq = ic->ic_bss->ni_chan->ic_freq;
3179 			tap->ar_chan_flags = ic->ic_bss->ni_chan->ic_flags;
3180 
3181 			/* TBD verify units are dB */
3182 			tap->ar_antsignal = (int)rssi;
3183 			/* TBD tap->ar_flags */
3184 
3185 			mb.m_data = (caddr_t)tap;
3186 			mb.m_len = tap->ar_ihdr.it_len;
3187 			mb.m_next = m;
3188 			mb.m_nextpkt = NULL;
3189 			mb.m_type = 0;
3190 			mb.m_flags = 0;
3191 			bpf_mtap(sc->sc_radiobpf, &mb, BPF_DIRECTION_IN);
3192  		}
3193 #endif /* NBPFILTER > 0 */
3194 
3195 		wh = mtod(m, struct ieee80211_frame *);
3196 		ni = ieee80211_find_rxnode(ic, wh);
3197 		rxi.rxi_flags = 0;
3198 #if 0
3199 		if (atw_hw_decrypted(sc, wh)) {
3200 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
3201 			rxi.rxi_flags |= IEEE80211_RXI_HWDEC;
3202 		}
3203 #endif
3204 		rxi.rxi_rssi = (int)rssi;
3205 		rxi.rxi_tstamp = 0;
3206 		ieee80211_input(ifp, m, ni, &rxi);
3207 		/*
3208 		 * The frame may have caused the node to be marked for
3209 		 * reclamation (e.g. in response to a DEAUTH message)
3210 		 * so use release_node here instead of unref_node.
3211 		 */
3212 		ieee80211_release_node(ic, ni);
3213 	}
3214 
3215 	/* Update the receive pointer. */
3216 	sc->sc_rxptr = i;
3217 }
3218 
3219 /*
3220  * atw_txintr:
3221  *
3222  *	Helper; handle transmit interrupts.
3223  */
3224 void
3225 atw_txintr(struct atw_softc *sc)
3226 {
3227 #define TXSTAT_ERRMASK (ATW_TXSTAT_TUF | ATW_TXSTAT_TLT | ATW_TXSTAT_TRT | \
3228     ATW_TXSTAT_TRO | ATW_TXSTAT_SOFBR)
3229 #define TXSTAT_FMT "\20\31ATW_TXSTAT_SOFBR\32ATW_TXSTAT_TRO\33ATW_TXSTAT_TUF" \
3230     "\34ATW_TXSTAT_TRT\35ATW_TXSTAT_TLT"
3231 	struct ifnet *ifp = &sc->sc_ic.ic_if;
3232 	struct atw_txsoft *txs;
3233 	u_int32_t txstat;
3234 
3235 	DPRINTF3(sc, ("%s: atw_txintr: sc_flags 0x%08x\n",
3236 	    sc->sc_dev.dv_xname, sc->sc_flags));
3237 
3238 	ifp->if_flags &= ~IFF_OACTIVE;
3239 
3240 	/*
3241 	 * Go through our Tx list and free mbufs for those
3242 	 * frames that have been transmitted.
3243 	 */
3244 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txdirtyq)) != NULL) {
3245 		ATW_CDTXSYNC(sc, txs->txs_lastdesc, 1,
3246 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3247 
3248 #ifdef ATW_DEBUG
3249 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3250 			int i;
3251 			printf("    txsoft %p transmit chain:\n", txs);
3252 			ATW_CDTXSYNC(sc, txs->txs_firstdesc,
3253 			    txs->txs_ndescs - 1,
3254 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
3255 			for (i = txs->txs_firstdesc;; i = ATW_NEXTTX(i)) {
3256 				printf("     descriptor %d:\n", i);
3257 				printf("       at_status:   0x%08x\n",
3258 				    letoh32(sc->sc_txdescs[i].at_stat));
3259 				printf("       at_flags:      0x%08x\n",
3260 				    letoh32(sc->sc_txdescs[i].at_flags));
3261 				printf("       at_buf1: 0x%08x\n",
3262 				    letoh32(sc->sc_txdescs[i].at_buf1));
3263 				printf("       at_buf2: 0x%08x\n",
3264 				    letoh32(sc->sc_txdescs[i].at_buf2));
3265 				if (i == txs->txs_lastdesc)
3266 					break;
3267 			}
3268 		}
3269 #endif
3270 
3271 		txstat = letoh32(sc->sc_txdescs[txs->txs_lastdesc].at_stat);
3272 		if (txstat & ATW_TXSTAT_OWN)
3273 			break;
3274 
3275 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txdirtyq, txs_q);
3276 
3277 		sc->sc_txfree += txs->txs_ndescs;
3278 
3279 		bus_dmamap_sync(sc->sc_dmat, txs->txs_dmamap,
3280 		    0, txs->txs_dmamap->dm_mapsize,
3281 		    BUS_DMASYNC_POSTWRITE);
3282 		bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
3283 		m_freem(txs->txs_mbuf);
3284 		txs->txs_mbuf = NULL;
3285 
3286 		SIMPLEQ_INSERT_TAIL(&sc->sc_txfreeq, txs, txs_q);
3287 
3288 		if ((ifp->if_flags & IFF_DEBUG) != 0 &&
3289 		    (txstat & TXSTAT_ERRMASK) != 0) {
3290 			printf("%s: txstat %b %d\n", sc->sc_dev.dv_xname,
3291 			    txstat & TXSTAT_ERRMASK, TXSTAT_FMT,
3292 			    MASK_AND_RSHIFT(txstat, ATW_TXSTAT_ARC_MASK));
3293 		}
3294 
3295 		/*
3296 		 * Check for errors and collisions.
3297 		 */
3298 		if (txstat & ATW_TXSTAT_TUF)
3299 			sc->sc_stats.ts_tx_tuf++;
3300 		if (txstat & ATW_TXSTAT_TLT)
3301 			sc->sc_stats.ts_tx_tlt++;
3302 		if (txstat & ATW_TXSTAT_TRT)
3303 			sc->sc_stats.ts_tx_trt++;
3304 		if (txstat & ATW_TXSTAT_TRO)
3305 			sc->sc_stats.ts_tx_tro++;
3306 		if (txstat & ATW_TXSTAT_SOFBR) {
3307 			sc->sc_stats.ts_tx_sofbr++;
3308 		}
3309 
3310 		if ((txstat & ATW_TXSTAT_ES) == 0)
3311 			ifp->if_collisions +=
3312 			    MASK_AND_RSHIFT(txstat, ATW_TXSTAT_ARC_MASK);
3313 		else
3314 			ifp->if_oerrors++;
3315 
3316 		ifp->if_opackets++;
3317 	}
3318 
3319 	/*
3320 	 * If there are no more pending transmissions, cancel the watchdog
3321 	 * timer.
3322 	 */
3323 	if (txs == NULL)
3324 		sc->sc_tx_timer = 0;
3325 #undef TXSTAT_ERRMASK
3326 #undef TXSTAT_FMT
3327 }
3328 
3329 /*
3330  * atw_watchdog:	[ifnet interface function]
3331  *
3332  *	Watchdog timer handler.
3333  */
3334 void
3335 atw_watchdog(struct ifnet *ifp)
3336 {
3337 	struct atw_softc *sc = ifp->if_softc;
3338 	struct ieee80211com *ic = &sc->sc_ic;
3339 	uint32_t test1, rra, rwa;
3340 
3341 	ifp->if_timer = 0;
3342 	if (ATW_IS_ENABLED(sc) == 0)
3343 		return;
3344 
3345 	if (sc->sc_rescan_timer) {
3346 		if (--sc->sc_rescan_timer == 0)
3347 			(void)ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3348 	}
3349 	if (sc->sc_tx_timer) {
3350 		if (--sc->sc_tx_timer == 0 &&
3351 		    !SIMPLEQ_EMPTY(&sc->sc_txdirtyq)) {
3352 			printf("%s: transmit timeout\n", ifp->if_xname);
3353 			ifp->if_oerrors++;
3354 			(void)atw_init(ifp);
3355 			atw_start(ifp);
3356 		}
3357 	}
3358 	if (sc->sc_tx_timer != 0 || sc->sc_rescan_timer != 0)
3359 		ifp->if_timer = 1;
3360 
3361 	/*
3362 	 * ADM8211B seems to stall every so often, check for this.
3363 	 * These bits are what the Linux driver checks, they don't
3364 	 * seem to be documented by ADMTek/Infineon?
3365 	 */
3366 	if (sc->sc_rev == ATW_REVISION_BA) {
3367 		test1 = ATW_READ(sc, ATW_TEST1);
3368 		rra = (test1 >> 12) & 0x1ff;
3369 		rwa = (test1 >> 2) & 0x1ff;
3370 
3371 		if ((rra != rwa) && !(test1 & 0x2)) {
3372 			atw_init(ifp);
3373 			atw_start(ifp);
3374 		}
3375 	}
3376 
3377 	ieee80211_watchdog(ifp);
3378 }
3379 
3380 /*
3381  * Arguments in:
3382  *
3383  * paylen:  payload length (no FCS, no WEP header)
3384  *
3385  * hdrlen:  header length
3386  *
3387  * rate:    MSDU speed, units 500kb/s
3388  *
3389  * flags:   IEEE80211_F_SHPREAMBLE (use short preamble),
3390  *          IEEE80211_F_SHSLOT (use short slot length)
3391  *
3392  * Arguments out:
3393  *
3394  * d:       802.11 Duration field for RTS,
3395  *          802.11 Duration field for data frame,
3396  *          PLCP Length for data frame,
3397  *          residual octets at end of data slot
3398  */
3399 int
3400 atw_compute_duration1(int len, int use_ack, uint32_t flags, int rate,
3401     struct atw_duration *d)
3402 {
3403 	int pre, ctsrate;
3404 	int ack, bitlen, data_dur, remainder;
3405 
3406 	/* RTS reserves medium for SIFS | CTS | SIFS | (DATA) | SIFS | ACK
3407 	 * DATA reserves medium for SIFS | ACK
3408 	 *
3409 	 * XXXMYC: no ACK on multicast/broadcast or control packets
3410 	 */
3411 
3412 	bitlen = len * 8;
3413 
3414 	pre = IEEE80211_DUR_DS_SIFS;
3415 	if ((flags & IEEE80211_F_SHPREAMBLE) != 0)
3416 		pre += IEEE80211_DUR_DS_SHORT_PREAMBLE +
3417 		    IEEE80211_DUR_DS_FAST_PLCPHDR;
3418 	else
3419 		pre += IEEE80211_DUR_DS_LONG_PREAMBLE +
3420 		    IEEE80211_DUR_DS_SLOW_PLCPHDR;
3421 
3422 	d->d_residue = 0;
3423 	data_dur = (bitlen * 2) / rate;
3424 	remainder = (bitlen * 2) % rate;
3425 	if (remainder != 0) {
3426 		d->d_residue = (rate - remainder) / 16;
3427 		data_dur++;
3428 	}
3429 
3430 	switch (rate) {
3431 	case 2:		/* 1 Mb/s */
3432 	case 4:		/* 2 Mb/s */
3433 		/* 1 - 2 Mb/s WLAN: send ACK/CTS at 1 Mb/s */
3434 		ctsrate = 2;
3435 		break;
3436 	case 11:	/* 5.5 Mb/s */
3437 	case 22:	/* 11  Mb/s */
3438 	case 44:	/* 22  Mb/s */
3439 		/* 5.5 - 11 Mb/s WLAN: send ACK/CTS at 2 Mb/s */
3440 		ctsrate = 4;
3441 		break;
3442 	default:
3443 		/* TBD */
3444 		return -1;
3445 	}
3446 
3447 	d->d_plcp_len = data_dur;
3448 
3449 	ack = (use_ack) ? pre + (IEEE80211_DUR_DS_SLOW_ACK * 2) / ctsrate : 0;
3450 
3451 	d->d_rts_dur =
3452 	    pre + (IEEE80211_DUR_DS_SLOW_CTS * 2) / ctsrate +
3453 	    pre + data_dur +
3454 	    ack;
3455 
3456 	d->d_data_dur = ack;
3457 
3458 	return 0;
3459 }
3460 
3461 /*
3462  * Arguments in:
3463  *
3464  * wh:      802.11 header
3465  *
3466  * len: packet length
3467  *
3468  * rate:    MSDU speed, units 500kb/s
3469  *
3470  * fraglen: fragment length, set to maximum (or higher) for no
3471  *          fragmentation
3472  *
3473  * flags:   IEEE80211_F_WEPON (hardware adds WEP),
3474  *          IEEE80211_F_SHPREAMBLE (use short preamble),
3475  *          IEEE80211_F_SHSLOT (use short slot length)
3476  *
3477  * Arguments out:
3478  *
3479  * d0: 802.11 Duration fields (RTS/Data), PLCP Length, Service fields
3480  *     of first/only fragment
3481  *
3482  * dn: 802.11 Duration fields (RTS/Data), PLCP Length, Service fields
3483  *     of first/only fragment
3484  */
3485 int
3486 atw_compute_duration(struct ieee80211_frame *wh, int len, uint32_t flags,
3487     int fraglen, int rate, struct atw_duration *d0, struct atw_duration *dn,
3488     int *npktp, int debug)
3489 {
3490 	int ack, rc;
3491 	int firstlen, hdrlen, lastlen, lastlen0, npkt, overlen, paylen;
3492 
3493 	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
3494 		hdrlen = sizeof(struct ieee80211_frame_addr4);
3495 	else
3496 		hdrlen = sizeof(struct ieee80211_frame);
3497 
3498 	paylen = len - hdrlen;
3499 
3500 	if ((flags & IEEE80211_F_WEPON) != 0)
3501 		overlen = IEEE80211_WEP_TOTLEN + IEEE80211_CRC_LEN;
3502 	else
3503 		overlen = IEEE80211_CRC_LEN;
3504 
3505 	npkt = paylen / fraglen;
3506 	lastlen0 = paylen % fraglen;
3507 
3508 	if (npkt == 0)			/* no fragments */
3509 		lastlen = paylen + overlen;
3510 	else if (lastlen0 != 0) {	/* a short "tail" fragment */
3511 		lastlen = lastlen0 + overlen;
3512 		npkt++;
3513 	} else				/* full-length "tail" fragment */
3514 		lastlen = fraglen + overlen;
3515 
3516 	if (npktp != NULL)
3517 		*npktp = npkt;
3518 
3519 	if (npkt > 1)
3520 		firstlen = fraglen + overlen;
3521 	else
3522 		firstlen = paylen + overlen;
3523 
3524 	if (debug) {
3525 		printf("%s: npkt %d firstlen %d lastlen0 %d lastlen %d "
3526 		    "fraglen %d overlen %d len %d rate %d flags %08x\n",
3527 		    __func__, npkt, firstlen, lastlen0, lastlen, fraglen,
3528 		    overlen, len, rate, flags);
3529 	}
3530 
3531 	ack = !IEEE80211_IS_MULTICAST(wh->i_addr1) &&
3532 	    (wh->i_fc[1] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_CTL;
3533 
3534 	rc = atw_compute_duration1(firstlen + hdrlen, ack, flags, rate, d0);
3535 	if (rc == -1)
3536 		return rc;
3537 
3538 	if (npkt <= 1) {
3539 		*dn = *d0;
3540 		return 0;
3541 	}
3542 	return atw_compute_duration1(lastlen + hdrlen, ack, flags, rate, dn);
3543 }
3544 
3545 #ifdef ATW_DEBUG
3546 void
3547 atw_dump_pkt(struct ifnet *ifp, struct mbuf *m0)
3548 {
3549 	struct atw_softc *sc = ifp->if_softc;
3550 	struct mbuf *m;
3551 	int i, noctets = 0;
3552 
3553 	printf("%s: %d-byte packet\n", sc->sc_dev.dv_xname,
3554 	    m0->m_pkthdr.len);
3555 
3556 	for (m = m0; m; m = m->m_next) {
3557 		if (m->m_len == 0)
3558 			continue;
3559 		for (i = 0; i < m->m_len; i++) {
3560 			printf(" %02x", ((u_int8_t*)m->m_data)[i]);
3561 			if (++noctets % 24 == 0)
3562 				printf("\n");
3563 		}
3564 	}
3565 	printf("%s%s: %d bytes emitted\n",
3566 	    (noctets % 24 != 0) ? "\n" : "", sc->sc_dev.dv_xname, noctets);
3567 }
3568 #endif /* ATW_DEBUG */
3569 
3570 /*
3571  * atw_start:		[ifnet interface function]
3572  *
3573  *	Start packet transmission on the interface.
3574  */
3575 void
3576 atw_start(struct ifnet *ifp)
3577 {
3578 	struct atw_softc *sc = ifp->if_softc;
3579 	struct ieee80211com *ic = &sc->sc_ic;
3580 	struct ieee80211_node *ni;
3581 	struct ieee80211_frame *wh;
3582 	struct ieee80211_key *k;
3583 	struct atw_frame *hh;
3584 	struct mbuf *m0, *m;
3585 	struct atw_txsoft *txs, *last_txs;
3586 	struct atw_txdesc *txd;
3587 	int do_encrypt, npkt, rate;
3588 	bus_dmamap_t dmamap;
3589 	int ctl, error, firsttx, nexttx, lasttx = -1, first, ofree, seg;
3590 
3591 	DPRINTF2(sc, ("%s: atw_start: sc_flags 0x%08x, if_flags 0x%08x\n",
3592 	    sc->sc_dev.dv_xname, sc->sc_flags, ifp->if_flags));
3593 
3594 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
3595 		return;
3596 
3597 	/*
3598 	 * Remember the previous number of free descriptors and
3599 	 * the first descriptor we'll use.
3600 	 */
3601 	ofree = sc->sc_txfree;
3602 	firsttx = sc->sc_txnext;
3603 
3604 	DPRINTF2(sc, ("%s: atw_start: txfree %d, txnext %d\n",
3605 	    sc->sc_dev.dv_xname, ofree, firsttx));
3606 
3607 	/*
3608 	 * Loop through the send queue, setting up transmit descriptors
3609 	 * until we drain the queue, or use up all available transmit
3610 	 * descriptors.
3611 	 */
3612 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txfreeq)) != NULL &&
3613 	       sc->sc_txfree != 0) {
3614 
3615 		/*
3616 		 * Grab a packet off the management queue, if it
3617 		 * is not empty. Otherwise, from the data queue.
3618 		 */
3619 		IF_DEQUEUE(&ic->ic_mgtq, m0);
3620 		if (m0 != NULL) {
3621 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
3622 			m0->m_pkthdr.rcvif = NULL;
3623 		} else {
3624 			/* send no data packets until we are associated */
3625 			if (ic->ic_state != IEEE80211_S_RUN)
3626 				break;
3627 			IFQ_DEQUEUE(&ifp->if_snd, m0);
3628 			if (m0 == NULL)
3629 				break;
3630 #if NBPFILTER > 0
3631 			if (ifp->if_bpf != NULL)
3632 				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
3633 #endif /* NBPFILTER > 0 */
3634 			if ((m0 = ieee80211_encap(ifp, m0, &ni)) == NULL) {
3635 				ifp->if_oerrors++;
3636 				break;
3637 			}
3638 
3639 			if (ic->ic_flags & IEEE80211_F_WEPON) {
3640 				wh = mtod(m0, struct ieee80211_frame *);
3641 				k = ieee80211_get_txkey(ic, wh, ni);
3642 				m0 = ieee80211_encrypt(ic, m0, k);
3643 				if (m0 == NULL) {
3644 					ifp->if_oerrors++;
3645 					break;
3646 				}
3647 			}
3648 		}
3649 
3650 		wh = mtod(m0, struct ieee80211_frame *);
3651 
3652 		/* XXX do real rate control */
3653 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
3654 		    IEEE80211_FC0_TYPE_MGT)
3655 			rate = 2;
3656 		else
3657 			rate = MAX(2, ieee80211_get_rate(ic));
3658 
3659 		if (atw_compute_duration(wh, m0->m_pkthdr.len,
3660 		    ic->ic_flags & ~IEEE80211_F_WEPON, ic->ic_fragthreshold,
3661 		    rate, &txs->txs_d0, &txs->txs_dn, &npkt,
3662 		    (sc->sc_if.if_flags & (IFF_DEBUG|IFF_LINK2)) ==
3663 		    (IFF_DEBUG|IFF_LINK2)) == -1) {
3664 			DPRINTF2(sc, ("%s: fail compute duration\n", __func__));
3665 			m_freem(m0);
3666 			break;
3667 		}
3668 
3669 		/*
3670 		 * XXX Misleading if fragmentation is enabled.  Better
3671 		 * to fragment in software?
3672 		 */
3673 		*(uint16_t *)wh->i_dur = htole16(txs->txs_d0.d_rts_dur);
3674 
3675 #if NBPFILTER > 0
3676 		/*
3677 		 * Pass the packet to any BPF listeners.
3678 		 */
3679 		if (ic->ic_rawbpf != NULL)
3680 			bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
3681 
3682 		if (sc->sc_radiobpf != NULL) {
3683 			struct mbuf mb;
3684 			struct atw_tx_radiotap_header *tap = &sc->sc_txtap;
3685 
3686 			tap->at_rate = rate;
3687 			tap->at_chan_freq = ic->ic_bss->ni_chan->ic_freq;
3688 			tap->at_chan_flags = ic->ic_bss->ni_chan->ic_flags;
3689 
3690 			/* TBD tap->at_flags */
3691 
3692 			mb.m_data = (caddr_t)tap;
3693 			mb.m_len = tap->at_ihdr.it_len;
3694 			mb.m_next = m0;
3695 			mb.m_nextpkt = NULL;
3696 			mb.m_type = 0;
3697 			mb.m_flags = 0;
3698 			bpf_mtap(sc->sc_radiobpf, &mb, BPF_DIRECTION_OUT);
3699 		}
3700 #endif /* NBPFILTER > 0 */
3701 
3702 		M_PREPEND(m0, offsetof(struct atw_frame, atw_ihdr), M_DONTWAIT);
3703 
3704 		if (ni != NULL)
3705 			ieee80211_release_node(ic, ni);
3706 
3707 		if (m0 == NULL) {
3708 			ifp->if_oerrors++;
3709 			break;
3710 		}
3711 
3712 		/* just to make sure. */
3713 		m0 = m_pullup(m0, sizeof(struct atw_frame));
3714 
3715 		if (m0 == NULL) {
3716 			ifp->if_oerrors++;
3717 			break;
3718 		}
3719 
3720 		hh = mtod(m0, struct atw_frame *);
3721 		wh = &hh->atw_ihdr;
3722 
3723 		do_encrypt = ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0) ? 1 : 0;
3724 
3725 		/* Copy everything we need from the 802.11 header:
3726 		 * Frame Control; address 1, address 3, or addresses
3727 		 * 3 and 4. NIC fills in BSSID, SA.
3728 		 */
3729 		if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) {
3730 			if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
3731 				panic("%s: illegal WDS frame",
3732 				    sc->sc_dev.dv_xname);
3733 			memcpy(hh->atw_dst, wh->i_addr3, IEEE80211_ADDR_LEN);
3734 		} else
3735 			memcpy(hh->atw_dst, wh->i_addr1, IEEE80211_ADDR_LEN);
3736 
3737 		*(u_int16_t*)hh->atw_fc = *(u_int16_t*)wh->i_fc;
3738 
3739 		/* initialize remaining Tx parameters */
3740 		memset(&hh->u, 0, sizeof(hh->u));
3741 
3742 		hh->atw_rate = rate * 5;
3743 		/* XXX this could be incorrect if M_FCS. _encap should
3744 		 * probably strip FCS just in case it sticks around in
3745 		 * bridged packets.
3746 		 */
3747 		hh->atw_service = IEEE80211_PLCP_SERVICE; /* XXX guess */
3748 		hh->atw_paylen = htole16(m0->m_pkthdr.len -
3749 		    sizeof(struct atw_frame));
3750 
3751 		hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);
3752 		hh->atw_rtylmt = 3;
3753 		hh->atw_hdrctl = htole16(ATW_HDRCTL_UNKNOWN1);
3754 #if 0
3755 		if (do_encrypt) {
3756 			hh->atw_hdrctl |= htole16(ATW_HDRCTL_WEP);
3757 			hh->atw_keyid = ic->ic_wep_txkey;
3758 		}
3759 #endif
3760 
3761 		hh->atw_head_plcplen = htole16(txs->txs_d0.d_plcp_len);
3762 		hh->atw_tail_plcplen = htole16(txs->txs_dn.d_plcp_len);
3763 		if (txs->txs_d0.d_residue)
3764 			hh->atw_head_plcplen |= htole16(0x8000);
3765 		if (txs->txs_dn.d_residue)
3766 			hh->atw_tail_plcplen |= htole16(0x8000);
3767 		hh->atw_head_dur = htole16(txs->txs_d0.d_rts_dur);
3768 		hh->atw_tail_dur = htole16(txs->txs_dn.d_rts_dur);
3769 
3770 		/* never fragment multicast frames */
3771 		if (IEEE80211_IS_MULTICAST(hh->atw_dst)) {
3772 			hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);
3773 		} else if (sc->sc_flags & ATWF_RTSCTS) {
3774 			hh->atw_hdrctl |= htole16(ATW_HDRCTL_RTSCTS);
3775 		}
3776 
3777 #ifdef ATW_DEBUG
3778 		hh->atw_fragnum = 0;
3779 
3780 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3781 			printf("%s: dst = %s, rate = 0x%02x, "
3782 			    "service = 0x%02x, paylen = 0x%04x\n",
3783 			    sc->sc_dev.dv_xname, ether_sprintf(hh->atw_dst),
3784 			    hh->atw_rate, hh->atw_service, hh->atw_paylen);
3785 
3786 			printf("%s: fc[0] = 0x%02x, fc[1] = 0x%02x, "
3787 			    "dur1 = 0x%04x, dur2 = 0x%04x, "
3788 			    "dur3 = 0x%04x, rts_dur = 0x%04x\n",
3789 			    sc->sc_dev.dv_xname, hh->atw_fc[0], hh->atw_fc[1],
3790 			    hh->atw_tail_plcplen, hh->atw_head_plcplen,
3791 			    hh->atw_tail_dur, hh->atw_head_dur);
3792 
3793 			printf("%s: hdrctl = 0x%04x, fragthr = 0x%04x, "
3794 			    "fragnum = 0x%02x, rtylmt = 0x%04x\n",
3795 			    sc->sc_dev.dv_xname, hh->atw_hdrctl,
3796 			    hh->atw_fragthr, hh->atw_fragnum, hh->atw_rtylmt);
3797 
3798 			printf("%s: keyid = %d\n",
3799 			    sc->sc_dev.dv_xname, hh->atw_keyid);
3800 
3801 			atw_dump_pkt(ifp, m0);
3802 		}
3803 #endif /* ATW_DEBUG */
3804 
3805 		dmamap = txs->txs_dmamap;
3806 
3807 		/*
3808 		 * Load the DMA map.  Copy and try (once) again if the packet
3809 		 * didn't fit in the alloted number of segments.
3810 		 */
3811 		for (first = 1;
3812 		     (error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap, m0,
3813 		                  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 && first;
3814 		     first = 0) {
3815 			MGETHDR(m, M_DONTWAIT, MT_DATA);
3816 			if (m == NULL) {
3817 				printf("%s: unable to allocate Tx mbuf\n",
3818 				    sc->sc_dev.dv_xname);
3819 				break;
3820 			}
3821 			if (m0->m_pkthdr.len > MHLEN) {
3822 				MCLGET(m, M_DONTWAIT);
3823 				if ((m->m_flags & M_EXT) == 0) {
3824 					printf("%s: unable to allocate Tx "
3825 					    "cluster\n", sc->sc_dev.dv_xname);
3826 					m_freem(m);
3827 					break;
3828 				}
3829 			}
3830 			m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
3831 			m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
3832 			m_freem(m0);
3833 			m0 = m;
3834 			m = NULL;
3835 		}
3836 		if (error != 0) {
3837 			printf("%s: unable to load Tx buffer, "
3838 			    "error = %d\n", sc->sc_dev.dv_xname, error);
3839 			m_freem(m0);
3840 			break;
3841 		}
3842 
3843 		/*
3844 		 * Ensure we have enough descriptors free to describe
3845 		 * the packet.
3846 		 */
3847 		if (dmamap->dm_nsegs > sc->sc_txfree) {
3848 			/*
3849 			 * Not enough free descriptors to transmit
3850 			 * this packet.  Unload the DMA map and
3851 			 * drop the packet.  Notify the upper layer
3852 			 * that there are no more slots left.
3853 			 *
3854 			 * XXX We could allocate an mbuf and copy, but
3855 			 * XXX it is worth it?
3856 			 */
3857 			ifp->if_flags |= IFF_OACTIVE;
3858 			bus_dmamap_unload(sc->sc_dmat, dmamap);
3859 			m_freem(m0);
3860 			break;
3861 		}
3862 
3863 		/*
3864 		 * WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.
3865 		 */
3866 
3867 		/* Sync the DMA map. */
3868 		bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
3869 		    BUS_DMASYNC_PREWRITE);
3870 
3871 		/* XXX arbitrary retry limit; 8 because I have seen it in
3872 		 * use already and maybe 0 means "no tries" !
3873 		 */
3874 		ctl = htole32(LSHIFT(8, ATW_TXCTL_TL_MASK));
3875 
3876 		DPRINTF2(sc, ("%s: TXDR <- max(10, %d)\n",
3877 		    sc->sc_dev.dv_xname, rate * 5));
3878 		ctl |= htole32(LSHIFT(MAX(10, rate * 5), ATW_TXCTL_TXDR_MASK));
3879 
3880 		/*
3881 		 * Initialize the transmit descriptors.
3882 		 */
3883 		for (nexttx = sc->sc_txnext, seg = 0;
3884 		     seg < dmamap->dm_nsegs;
3885 		     seg++, nexttx = ATW_NEXTTX(nexttx)) {
3886 			/*
3887 			 * If this is the first descriptor we're
3888 			 * enqueueing, don't set the OWN bit just
3889 			 * yet.  That could cause a race condition.
3890 			 * We'll do it below.
3891 			 */
3892 			txd = &sc->sc_txdescs[nexttx];
3893 			txd->at_ctl = ctl |
3894 			    ((nexttx == firsttx) ? 0 : htole32(ATW_TXCTL_OWN));
3895 
3896 			txd->at_buf1 = htole32(dmamap->dm_segs[seg].ds_addr);
3897 			txd->at_flags =
3898 			    htole32(LSHIFT(dmamap->dm_segs[seg].ds_len,
3899 			                   ATW_TXFLAG_TBS1_MASK)) |
3900 			    ((nexttx == (ATW_NTXDESC - 1))
3901 			        ? htole32(ATW_TXFLAG_TER) : 0);
3902 			lasttx = nexttx;
3903 		}
3904 
3905 		if (lasttx == -1)
3906 			panic("%s: bad lastx", ifp->if_xname);
3907 		/* Set `first segment' and `last segment' appropriately. */
3908 		sc->sc_txdescs[sc->sc_txnext].at_flags |=
3909 		    htole32(ATW_TXFLAG_FS);
3910 		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_LS);
3911 
3912 #ifdef ATW_DEBUG
3913 		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {
3914 			printf("     txsoft %p transmit chain:\n", txs);
3915 			for (seg = sc->sc_txnext;; seg = ATW_NEXTTX(seg)) {
3916 				printf("     descriptor %d:\n", seg);
3917 				printf("       at_ctl:   0x%08x\n",
3918 				    letoh32(sc->sc_txdescs[seg].at_ctl));
3919 				printf("       at_flags:      0x%08x\n",
3920 				    letoh32(sc->sc_txdescs[seg].at_flags));
3921 				printf("       at_buf1: 0x%08x\n",
3922 				    letoh32(sc->sc_txdescs[seg].at_buf1));
3923 				printf("       at_buf2: 0x%08x\n",
3924 				    letoh32(sc->sc_txdescs[seg].at_buf2));
3925 				if (seg == lasttx)
3926 					break;
3927 			}
3928 		}
3929 #endif
3930 
3931 		/* Sync the descriptors we're using. */
3932 		ATW_CDTXSYNC(sc, sc->sc_txnext, dmamap->dm_nsegs,
3933 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3934 
3935 		/*
3936 		 * Store a pointer to the packet so we can free it later,
3937 		 * and remember what txdirty will be once the packet is
3938 		 * done.
3939 		 */
3940 		txs->txs_mbuf = m0;
3941 		txs->txs_firstdesc = sc->sc_txnext;
3942 		txs->txs_lastdesc = lasttx;
3943 		txs->txs_ndescs = dmamap->dm_nsegs;
3944 
3945 		/* Advance the tx pointer. */
3946 		sc->sc_txfree -= dmamap->dm_nsegs;
3947 		sc->sc_txnext = nexttx;
3948 
3949 		SIMPLEQ_REMOVE_HEAD(&sc->sc_txfreeq, txs_q);
3950 		SIMPLEQ_INSERT_TAIL(&sc->sc_txdirtyq, txs, txs_q);
3951 
3952 		last_txs = txs;
3953 	}
3954 
3955 	if (txs == NULL || sc->sc_txfree == 0) {
3956 		/* No more slots left; notify upper layer. */
3957 		ifp->if_flags |= IFF_OACTIVE;
3958 	}
3959 
3960 	if (sc->sc_txfree != ofree) {
3961 		DPRINTF2(sc, ("%s: packets enqueued, IC on %d, OWN on %d\n",
3962 		    sc->sc_dev.dv_xname, lasttx, firsttx));
3963 		/*
3964 		 * Cause a transmit interrupt to happen on the
3965 		 * last packet we enqueued.
3966 		 */
3967 		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_IC);
3968 		ATW_CDTXSYNC(sc, lasttx, 1,
3969 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3970 
3971 		/*
3972 		 * The entire packet chain is set up.  Give the
3973 		 * first descriptor to the chip now.
3974 		 */
3975 		sc->sc_txdescs[firsttx].at_ctl |= htole32(ATW_TXCTL_OWN);
3976 		ATW_CDTXSYNC(sc, firsttx, 1,
3977 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3978 
3979 		/* Wake up the transmitter. */
3980 		ATW_WRITE(sc, ATW_TDR, 0x1);
3981 
3982 		/* Set a watchdog timer in case the chip flakes out. */
3983 		sc->sc_tx_timer = 5;
3984 		ifp->if_timer = 1;
3985 	}
3986 }
3987 
3988 /*
3989  * atw_power:
3990  *
3991  *	Power management (suspend/resume) hook.
3992  */
3993 void
3994 atw_power(int why, void *arg)
3995 {
3996 	struct atw_softc *sc = arg;
3997 	struct ifnet *ifp = &sc->sc_ic.ic_if;
3998 	int s;
3999 
4000 	DPRINTF(sc, ("%s: atw_power(%d,)\n", sc->sc_dev.dv_xname, why));
4001 
4002 	s = splnet();
4003 	switch (why) {
4004 	case PWR_STANDBY:
4005 		/* XXX do nothing. */
4006 		break;
4007 	case PWR_SUSPEND:
4008 		atw_stop(ifp, 1);
4009 		if (sc->sc_power != NULL)
4010 			(*sc->sc_power)(sc, why);
4011 		break;
4012 	case PWR_RESUME:
4013 		if (ifp->if_flags & IFF_UP) {
4014 			if (sc->sc_power != NULL)
4015 				(*sc->sc_power)(sc, why);
4016 			atw_init(ifp);
4017 		}
4018 		break;
4019 	}
4020 	splx(s);
4021 }
4022 
4023 /*
4024  * atw_ioctl:		[ifnet interface function]
4025  *
4026  *	Handle control requests from the operator.
4027  */
4028 int
4029 atw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
4030 {
4031 	struct atw_softc *sc = ifp->if_softc;
4032 	struct ieee80211com *ic = &sc->sc_ic;
4033 	struct ifreq *ifr = (struct ifreq *)data;
4034    	struct ifaddr *ifa = (struct ifaddr *)data;
4035 	int s, error = 0;
4036 
4037 	/* XXX monkey see, monkey do. comes from wi_ioctl. */
4038 	if ((sc->sc_dev.dv_flags & DVF_ACTIVE) == 0)
4039 		return ENXIO;
4040 
4041 	s = splnet();
4042 
4043 	switch (cmd) {
4044         case SIOCSIFADDR:
4045                 ifp->if_flags |= IFF_UP;
4046 #ifdef INET
4047                 if (ifa->ifa_addr->sa_family == AF_INET) {
4048                         arp_ifinit(&ic->ic_ac, ifa);
4049                 }
4050 #endif  /* INET */
4051 		/* FALLTHROUGH */
4052 
4053 	case SIOCSIFFLAGS:
4054 		if (ifp->if_flags & IFF_UP) {
4055 			if (ATW_IS_ENABLED(sc)) {
4056 				/*
4057 				 * To avoid rescanning another access point,
4058 				 * do not call atw_init() here.  Instead,
4059 				 * only reflect media settings.
4060 				 */
4061 				atw_filter_setup(sc);
4062 			} else
4063 				error = atw_init(ifp);
4064 		} else if (ATW_IS_ENABLED(sc))
4065 			atw_stop(ifp, 1);
4066 		break;
4067 
4068 	case SIOCADDMULTI:
4069 	case SIOCDELMULTI:
4070 		error = (cmd == SIOCADDMULTI) ?
4071 		    ether_addmulti(ifr, &sc->sc_ic.ic_ac) :
4072 		    ether_delmulti(ifr, &sc->sc_ic.ic_ac);
4073 
4074 		if (error == ENETRESET) {
4075 			if (ifp->if_flags & IFF_RUNNING)
4076 				atw_filter_setup(sc); /* do not rescan */
4077 			error = 0;
4078 		}
4079 		break;
4080 
4081 	default:
4082 		error = ieee80211_ioctl(ifp, cmd, data);
4083 		if (error == ENETRESET) {
4084 			if (ATW_IS_ENABLED(sc))
4085 				error = atw_init(ifp);
4086 			else
4087 				error = 0;
4088 		}
4089 		break;
4090 	}
4091 
4092 	/* Try to get more packets going. */
4093 	if (ATW_IS_ENABLED(sc))
4094 		atw_start(ifp);
4095 
4096 	splx(s);
4097 	return (error);
4098 }
4099 
4100 int
4101 atw_media_change(struct ifnet *ifp)
4102 {
4103 	int error;
4104 
4105 	error = ieee80211_media_change(ifp);
4106 	if (error == ENETRESET) {
4107 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
4108 		    (IFF_RUNNING|IFF_UP))
4109 			atw_init(ifp);		/* XXX lose error */
4110 		error = 0;
4111 	}
4112 	return error;
4113 }
4114 
4115 void
4116 atw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
4117 {
4118 	struct atw_softc *sc = ifp->if_softc;
4119 
4120 	if (ATW_IS_ENABLED(sc) == 0) {
4121 		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
4122 		imr->ifm_status = 0;
4123 		return;
4124 	}
4125 	ieee80211_media_status(ifp, imr);
4126 }
4127